@alessandroraffa/tangyr 0.13.0 → 0.14.1

package/dist/index.js

@@ -1372,8 +1372,8 @@ var require_command = __commonJS({
     "use strict";
     var EventEmitter = __require("events").EventEmitter;
     var childProcess = __require("child_process");
-    var path44 = __require("path");
-    var fs43 = __require("fs");
+    var path45 = __require("path");
+    var fs44 = __require("fs");
     var process5 = __require("process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -2367,7 +2367,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} subcommandName
        */
       _checkForMissingExecutable(executableFile, executableDir, subcommandName) {
-        if (fs43.existsSync(executableFile)) return;
+        if (fs44.existsSync(executableFile)) return;
         const executableDirMessage = executableDir ? `searched for local subcommand relative to directory '${executableDir}'` : "no directory for search for local subcommand, use .executableDir() to supply a custom directory";
         const executableMissing = `'${executableFile}' does not exist
  - if '${subcommandName}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead
@@ -2385,11 +2385,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path44.resolve(baseDir, baseName);
-          if (fs43.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path44.extname(baseName))) return void 0;
+          const localBin = path45.resolve(baseDir, baseName);
+          if (fs44.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path45.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext) => fs43.existsSync(`${localBin}${ext}`)
+            (ext) => fs44.existsSync(`${localBin}${ext}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -2401,21 +2401,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs43.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs44.realpathSync(this._scriptPath);
           } catch {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path44.resolve(
-            path44.dirname(resolvedScriptPath),
+          executableDir = path45.resolve(
+            path45.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path44.basename(
+            const legacyName = path45.basename(
               this._scriptPath,
-              path44.extname(this._scriptPath)
+              path45.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -2426,7 +2426,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path44.extname(executableFile));
+        launchWithNode = sourceExt.includes(path45.extname(executableFile));
         let proc;
         if (process5.platform !== "win32") {
           if (launchWithNode) {
@@ -3341,7 +3341,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path44.basename(filename, path44.extname(filename));
+        this._name = path45.basename(filename, path45.extname(filename));
         return this;
       }
       /**
@@ -3355,9 +3355,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path45) {
-        if (path45 === void 0) return this._executableDir;
-        this._executableDir = path45;
+      executableDir(path46) {
+        if (path46 === void 0) return this._executableDir;
+        this._executableDir = path46;
         return this;
       }
       /**
@@ -3713,17 +3713,17 @@ var require_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    function visit_(key, node, visitor, path44) {
-      const ctrl = callVisitor(key, node, visitor, path44);
+    function visit_(key, node, visitor, path45) {
+      const ctrl = callVisitor(key, node, visitor, path45);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path44, ctrl);
-        return visit_(key, ctrl, visitor, path44);
+        replaceNode(key, path45, ctrl);
+        return visit_(key, ctrl, visitor, path45);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path44 = Object.freeze(path44.concat(node));
+          path45 = Object.freeze(path45.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci2 = visit_(i, node.items[i], visitor, path44);
+            const ci2 = visit_(i, node.items[i], visitor, path45);
             if (typeof ci2 === "number")
               i = ci2 - 1;
             else if (ci2 === BREAK)
@@ -3734,13 +3734,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path44 = Object.freeze(path44.concat(node));
-          const ck = visit_("key", node.key, visitor, path44);
+          path45 = Object.freeze(path45.concat(node));
+          const ck = visit_("key", node.key, visitor, path45);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = visit_("value", node.value, visitor, path44);
+          const cv = visit_("value", node.value, visitor, path45);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -3761,17 +3761,17 @@ var require_visit = __commonJS({
     visitAsync.BREAK = BREAK;
     visitAsync.SKIP = SKIP;
     visitAsync.REMOVE = REMOVE;
-    async function visitAsync_(key, node, visitor, path44) {
-      const ctrl = await callVisitor(key, node, visitor, path44);
+    async function visitAsync_(key, node, visitor, path45) {
+      const ctrl = await callVisitor(key, node, visitor, path45);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path44, ctrl);
-        return visitAsync_(key, ctrl, visitor, path44);
+        replaceNode(key, path45, ctrl);
+        return visitAsync_(key, ctrl, visitor, path45);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path44 = Object.freeze(path44.concat(node));
+          path45 = Object.freeze(path45.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci2 = await visitAsync_(i, node.items[i], visitor, path44);
+            const ci2 = await visitAsync_(i, node.items[i], visitor, path45);
             if (typeof ci2 === "number")
               i = ci2 - 1;
             else if (ci2 === BREAK)
@@ -3782,13 +3782,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path44 = Object.freeze(path44.concat(node));
-          const ck = await visitAsync_("key", node.key, visitor, path44);
+          path45 = Object.freeze(path45.concat(node));
+          const ck = await visitAsync_("key", node.key, visitor, path45);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = await visitAsync_("value", node.value, visitor, path44);
+          const cv = await visitAsync_("value", node.value, visitor, path45);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -3815,23 +3815,23 @@ var require_visit = __commonJS({
       }
       return visitor;
     }
-    function callVisitor(key, node, visitor, path44) {
+    function callVisitor(key, node, visitor, path45) {
       if (typeof visitor === "function")
-        return visitor(key, node, path44);
+        return visitor(key, node, path45);
       if (identity.isMap(node))
-        return visitor.Map?.(key, node, path44);
+        return visitor.Map?.(key, node, path45);
       if (identity.isSeq(node))
-        return visitor.Seq?.(key, node, path44);
+        return visitor.Seq?.(key, node, path45);
       if (identity.isPair(node))
-        return visitor.Pair?.(key, node, path44);
+        return visitor.Pair?.(key, node, path45);
       if (identity.isScalar(node))
-        return visitor.Scalar?.(key, node, path44);
+        return visitor.Scalar?.(key, node, path45);
       if (identity.isAlias(node))
-        return visitor.Alias?.(key, node, path44);
+        return visitor.Alias?.(key, node, path45);
       return void 0;
     }
-    function replaceNode(key, path44, node) {
-      const parent = path44[path44.length - 1];
+    function replaceNode(key, path45, node) {
+      const parent = path45[path45.length - 1];
       if (identity.isCollection(parent)) {
         parent.items[key] = node;
       } else if (identity.isPair(parent)) {
@@ -4439,10 +4439,10 @@ var require_Collection = __commonJS({
     var createNode = require_createNode();
     var identity = require_identity();
     var Node = require_Node();
-    function collectionFromPath(schema, path44, value) {
+    function collectionFromPath(schema, path45, value) {
       let v2 = value;
-      for (let i = path44.length - 1; i >= 0; --i) {
-        const k2 = path44[i];
+      for (let i = path45.length - 1; i >= 0; --i) {
+        const k2 = path45[i];
         if (typeof k2 === "number" && Number.isInteger(k2) && k2 >= 0) {
           const a = [];
           a[k2] = v2;
@@ -4461,7 +4461,7 @@ var require_Collection = __commonJS({
         sourceObjects: /* @__PURE__ */ new Map()
       });
     }
-    var isEmptyPath = (path44) => path44 == null || typeof path44 === "object" && !!path44[Symbol.iterator]().next().done;
+    var isEmptyPath = (path45) => path45 == null || typeof path45 === "object" && !!path45[Symbol.iterator]().next().done;
     var Collection = class extends Node.NodeBase {
       constructor(type, schema) {
         super(type);
@@ -4491,11 +4491,11 @@ var require_Collection = __commonJS({
        * be a Pair instance or a `{ key, value }` object, which may not have a key
        * that already exists in the map.
        */
-      addIn(path44, value) {
-        if (isEmptyPath(path44))
+      addIn(path45, value) {
+        if (isEmptyPath(path45))
           this.add(value);
         else {
-          const [key, ...rest] = path44;
+          const [key, ...rest] = path45;
           const node = this.get(key, true);
           if (identity.isCollection(node))
             node.addIn(rest, value);
@@ -4509,8 +4509,8 @@ var require_Collection = __commonJS({
        * Removes a value from the collection.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path44) {
-        const [key, ...rest] = path44;
+      deleteIn(path45) {
+        const [key, ...rest] = path45;
         if (rest.length === 0)
           return this.delete(key);
         const node = this.get(key, true);
@@ -4524,8 +4524,8 @@ var require_Collection = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path44, keepScalar) {
-        const [key, ...rest] = path44;
+      getIn(path45, keepScalar) {
+        const [key, ...rest] = path45;
         const node = this.get(key, true);
         if (rest.length === 0)
           return !keepScalar && identity.isScalar(node) ? node.value : node;
@@ -4543,8 +4543,8 @@ var require_Collection = __commonJS({
       /**
        * Checks if the collection includes a value with the key `key`.
        */
-      hasIn(path44) {
-        const [key, ...rest] = path44;
+      hasIn(path45) {
+        const [key, ...rest] = path45;
         if (rest.length === 0)
           return this.has(key);
         const node = this.get(key, true);
@@ -4554,8 +4554,8 @@ var require_Collection = __commonJS({
        * Sets a value in this collection. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path44, value) {
-        const [key, ...rest] = path44;
+      setIn(path45, value) {
+        const [key, ...rest] = path45;
         if (rest.length === 0) {
           this.set(key, value);
         } else {
@@ -7067,9 +7067,9 @@ var require_Document = __commonJS({
           this.contents.add(value);
       }
       /** Adds a value to the document. */
-      addIn(path44, value) {
+      addIn(path45, value) {
         if (assertCollection(this.contents))
-          this.contents.addIn(path44, value);
+          this.contents.addIn(path45, value);
       }
       /**
        * Create a new `Alias` node, ensuring that the target `node` has the required anchor.
@@ -7144,14 +7144,14 @@ var require_Document = __commonJS({
        * Removes a value from the document.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path44) {
-        if (Collection.isEmptyPath(path44)) {
+      deleteIn(path45) {
+        if (Collection.isEmptyPath(path45)) {
           if (this.contents == null)
             return false;
           this.contents = null;
           return true;
         }
-        return assertCollection(this.contents) ? this.contents.deleteIn(path44) : false;
+        return assertCollection(this.contents) ? this.contents.deleteIn(path45) : false;
       }
       /**
        * Returns item at `key`, or `undefined` if not found. By default unwraps
@@ -7166,10 +7166,10 @@ var require_Document = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path44, keepScalar) {
-        if (Collection.isEmptyPath(path44))
+      getIn(path45, keepScalar) {
+        if (Collection.isEmptyPath(path45))
           return !keepScalar && identity.isScalar(this.contents) ? this.contents.value : this.contents;
-        return identity.isCollection(this.contents) ? this.contents.getIn(path44, keepScalar) : void 0;
+        return identity.isCollection(this.contents) ? this.contents.getIn(path45, keepScalar) : void 0;
       }
       /**
        * Checks if the document includes a value with the key `key`.
@@ -7180,10 +7180,10 @@ var require_Document = __commonJS({
       /**
        * Checks if the document includes a value at `path`.
        */
-      hasIn(path44) {
-        if (Collection.isEmptyPath(path44))
+      hasIn(path45) {
+        if (Collection.isEmptyPath(path45))
           return this.contents !== void 0;
-        return identity.isCollection(this.contents) ? this.contents.hasIn(path44) : false;
+        return identity.isCollection(this.contents) ? this.contents.hasIn(path45) : false;
       }
       /**
        * Sets a value in this document. For `!!set`, `value` needs to be a
@@ -7200,13 +7200,13 @@ var require_Document = __commonJS({
        * Sets a value in this document. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path44, value) {
-        if (Collection.isEmptyPath(path44)) {
+      setIn(path45, value) {
+        if (Collection.isEmptyPath(path45)) {
           this.contents = value;
         } else if (this.contents == null) {
-          this.contents = Collection.collectionFromPath(this.schema, Array.from(path44), value);
+          this.contents = Collection.collectionFromPath(this.schema, Array.from(path45), value);
         } else if (assertCollection(this.contents)) {
-          this.contents.setIn(path44, value);
+          this.contents.setIn(path45, value);
         }
       }
       /**
@@ -9163,9 +9163,9 @@ var require_cst_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    visit.itemAtPath = (cst, path44) => {
+    visit.itemAtPath = (cst, path45) => {
       let item = cst;
-      for (const [field, index] of path44) {
+      for (const [field, index] of path45) {
         const tok = item?.[field];
         if (tok && "items" in tok) {
           item = tok.items[index];
@@ -9174,23 +9174,23 @@ var require_cst_visit = __commonJS({
       }
       return item;
     };
-    visit.parentCollection = (cst, path44) => {
-      const parent = visit.itemAtPath(cst, path44.slice(0, -1));
-      const field = path44[path44.length - 1][0];
+    visit.parentCollection = (cst, path45) => {
+      const parent = visit.itemAtPath(cst, path45.slice(0, -1));
+      const field = path45[path45.length - 1][0];
       const coll = parent?.[field];
       if (coll && "items" in coll)
         return coll;
       throw new Error("Parent collection not found");
     };
-    function _visit(path44, item, visitor) {
-      let ctrl = visitor(item, path44);
+    function _visit(path45, item, visitor) {
+      let ctrl = visitor(item, path45);
       if (typeof ctrl === "symbol")
         return ctrl;
       for (const field of ["key", "value"]) {
         const token = item[field];
         if (token && "items" in token) {
           for (let i = 0; i < token.items.length; ++i) {
-            const ci2 = _visit(Object.freeze(path44.concat([[field, i]])), token.items[i], visitor);
+            const ci2 = _visit(Object.freeze(path45.concat([[field, i]])), token.items[i], visitor);
             if (typeof ci2 === "number")
               i = ci2 - 1;
             else if (ci2 === BREAK)
@@ -9201,10 +9201,10 @@ var require_cst_visit = __commonJS({
             }
           }
           if (typeof ctrl === "function" && field === "key")
-            ctrl = ctrl(item, path44);
+            ctrl = ctrl(item, path45);
         }
       }
-      return typeof ctrl === "function" ? ctrl(item, path44) : ctrl;
+      return typeof ctrl === "function" ? ctrl(item, path45) : ctrl;
     }
     exports2.visit = visit;
   }
@@ -10489,14 +10489,14 @@ var require_parser = __commonJS({
             case "scalar":
             case "single-quoted-scalar":
             case "double-quoted-scalar": {
-              const fs43 = this.flowScalar(this.type);
+              const fs44 = this.flowScalar(this.type);
               if (atNextItem || it2.value) {
-                map.items.push({ start, key: fs43, sep: [] });
+                map.items.push({ start, key: fs44, sep: [] });
                 this.onKeyLine = true;
               } else if (it2.sep) {
-                this.stack.push(fs43);
+                this.stack.push(fs44);
               } else {
-                Object.assign(it2, { key: fs43, sep: [] });
+                Object.assign(it2, { key: fs44, sep: [] });
                 this.onKeyLine = true;
               }
               return;
@@ -10624,13 +10624,13 @@ var require_parser = __commonJS({
             case "scalar":
             case "single-quoted-scalar":
             case "double-quoted-scalar": {
-              const fs43 = this.flowScalar(this.type);
+              const fs44 = this.flowScalar(this.type);
               if (!it2 || it2.value)
-                fc.items.push({ start: [], key: fs43, sep: [] });
+                fc.items.push({ start: [], key: fs44, sep: [] });
               else if (it2.sep)
-                this.stack.push(fs43);
+                this.stack.push(fs44);
               else
-                Object.assign(it2, { key: fs43, sep: [] });
+                Object.assign(it2, { key: fs44, sep: [] });
               return;
             }
             case "flow-map-end":
@@ -23113,15 +23113,20 @@ function toConflictPolicy2(value) {
 }
 
 // src/commands/install.ts
-import fs35 from "fs";
-import path35 from "path";
+import fs36 from "fs";
+import path36 from "path";
 
 // src/core/materialize.ts
-import fs28 from "fs";
-import path26 from "path";
+import fs29 from "fs";
+import path27 from "path";
 
 // src/core/integrity.ts
 import crypto3 from "crypto";
+
+// src/core/bundle.ts
+var DENY_LIST_TYPE = "tangyr.deny-list.v2";
+
+// src/core/integrity.ts
 function canonicalize(value) {
   if (Array.isArray(value)) {
     return value.map(canonicalize);
@@ -23237,21 +23242,139 @@ function verifyBundle(bundle, keys, expectedIdentity, now) {
   verifyIdentity(bundle.manifest, expectedIdentity);
 }
 function verifyDenyList(denyList, keys, now) {
-  const isWellFormed = denyList !== null && typeof denyList === "object" && typeof denyList.keyId === "string" && typeof denyList.signature === "string" && denyList.signature.length > 0 && Array.isArray(denyList.entries) && denyList.entries.every(
-    (entry) => typeof entry === "string"
-  );
-  if (!isWellFormed) {
+  if (denyList === null || typeof denyList !== "object") {
+    throw new IntegrityError(DENY_LIST_MALFORMED);
+  }
+  const actualKeys = Object.keys(denyList).sort();
+  const expectedKeys = [
+    "entries",
+    "expiresAt",
+    "issuedAt",
+    "keyId",
+    "sequence",
+    "signature",
+    "type"
+  ];
+  if (actualKeys.length !== expectedKeys.length || actualKeys.some((key, index) => key !== expectedKeys[index])) {
     throw new IntegrityError(
-      "Revocation deny-list response is malformed, unsigned, or corrupted \u2014 treated as an integrity failure, never as an absent deny-list (REQ-INT-009)."
+      `${DENY_LIST_MALFORMED} Expected exactly [${expectedKeys.join(", ")}], got [${actualKeys.join(", ")}].`
     );
   }
   const list = denyList;
-  const canonicalBytes = canonicalJsonBytes({
-    keyId: list.keyId,
-    entries: list.entries
+  const shapeOk = list.type === DENY_LIST_TYPE && typeof list.keyId === "string" && typeof list.signature === "string" && list.signature.length > 0 && Number.isSafeInteger(list.sequence) && list.sequence >= 0 && typeof list.issuedAt === "string" && typeof list.expiresAt === "string" && Array.isArray(list.entries) && list.entries.every((entry) => typeof entry === "string");
+  if (!shapeOk) {
+    throw new IntegrityError(DENY_LIST_MALFORMED);
+  }
+  const { signature, ...signed } = list;
+  verifySignedPayload(
+    canonicalJsonBytes(signed),
+    signature,
+    list.keyId,
+    keys,
+    now
+  );
+  assertFreshnessWindow(list.issuedAt, list.expiresAt, now);
+  return list;
+}
+var DENY_LIST_MALFORMED = "Revocation deny-list response is malformed, unsigned, or corrupted \u2014 treated as an integrity failure, never as an absent deny-list (REQ-INT-009).";
+function assertFreshnessWindow(issuedAt, expiresAt, now) {
+  const utcDesignatorPattern = /Z|[+-]\d{2}:\d{2}$/;
+  if (!utcDesignatorPattern.test(issuedAt) || !utcDesignatorPattern.test(expiresAt)) {
+    throw new IntegrityError(
+      `Signed document has a timezone-ambiguous validity window (issuedAt "${issuedAt}", expiresAt "${expiresAt}") \u2014 an explicit UTC designator ("Z") or numeric offset is required.`
+    );
+  }
+  const issued = new Date(issuedAt);
+  const expires = new Date(expiresAt);
+  if (Number.isNaN(issued.getTime()) || Number.isNaN(expires.getTime())) {
+    throw new IntegrityError(
+      `Signed document has an unparseable validity window (issuedAt "${issuedAt}", expiresAt "${expiresAt}").`
+    );
+  }
+  if (expires.getTime() < issued.getTime()) {
+    throw new IntegrityError(
+      `Signed document expires (${expiresAt}) before it was issued (${issuedAt}) \u2014 refusing.`
+    );
+  }
+  if (now.getTime() > expires.getTime()) {
+    throw new IntegrityError(
+      `Signed document expired at ${expiresAt} (now ${now.toISOString()}). An expired revocation deny-list is not evidence that nothing is revoked \u2014 the publisher must re-sign and republish it.`
+    );
+  }
+  if (now.getTime() < issued.getTime()) {
+    throw new IntegrityError(
+      `Signed document is not yet valid: issued at ${issuedAt}, now ${now.toISOString()}. Check the local clock.`
+    );
+  }
+}
+
+// src/core/revocation-state.ts
+import fs28 from "fs";
+import path26 from "path";
+var REVOCATION_STATE_FILENAME = ".tangyr-revocation.json";
+function stateFilePath(cacheRoot) {
+  return path26.join(cacheRoot, REVOCATION_STATE_FILENAME);
+}
+function readState(cacheRoot) {
+  const filePath = stateFilePath(cacheRoot);
+  let raw;
+  try {
+    raw = fs28.readFileSync(filePath, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { state: {} };
+    }
+    return {
+      state: {},
+      warning: `Could not read ${filePath} (${err.message}); the deny-list replay guard starts from nothing for this run.`
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return {
+      state: {},
+      warning: `${filePath} is not valid JSON; the deny-list replay guard starts from nothing for this run.`
+    };
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return {
+      state: {},
+      warning: `${filePath} does not contain an object; the deny-list replay guard starts from nothing for this run.`
+    };
+  }
+  return { state: parsed };
+}
+function readRevocationSequence(cacheRoot, originUrl) {
+  const { state, warning } = readState(cacheRoot);
+  const record = state[originUrl];
+  const sequence = record !== void 0 && Number.isSafeInteger(record.sequence) ? record.sequence : void 0;
+  return warning === void 0 ? { sequence } : { sequence, warning };
+}
+function writeRevocationSequence(cacheRoot, originUrl, sequence, now) {
+  const { state } = readState(cacheRoot);
+  const existing = state[originUrl]?.sequence;
+  if (existing !== void 0 && existing >= sequence) {
+    return;
+  }
+  state[originUrl] = { sequence, seenAt: now.toISOString() };
+  const filePath = stateFilePath(cacheRoot);
+  fs28.mkdirSync(path26.dirname(filePath), { recursive: true, mode: 448 });
+  const tempPath = `${filePath}.${process.pid}.tmp`;
+  fs28.writeFileSync(tempPath, `${JSON.stringify(state, null, 2)}
+`, {
+    mode: 384
   });
-  verifySignedPayload(canonicalBytes, list.signature, list.keyId, keys, now);
-  return list.entries;
+  fs28.renameSync(tempPath, filePath);
+}
+function assertSequenceNotReplayed(params) {
+  const { originUrl, seen, incoming } = params;
+  if (seen !== void 0 && incoming < seen) {
+    throw new IntegrityError(
+      `Revocation deny-list from ${originUrl} carries sequence ${incoming}, behind the highest already accepted (${seen}). That is a replay of a superseded deny-list, which would silently un-revoke a kit \u2014 refusing (REQ-INT-009).`
+    );
+  }
 }
 
 // src/core/materialize.ts
@@ -23365,7 +23488,7 @@ async function assertReferenceNotRevoked(params) {
     sleep: sleep2
   } = params;
   const credentials = resolveCredentialNonInteractive();
-  const deniedEntries = await withBoundedRetry(
+  const denyList = await withBoundedRetry(
     async () => {
       const controller = new AbortController();
       const response = await transport.fetchObjectStream(
@@ -23402,11 +23525,21 @@ async function assertReferenceNotRevoked(params) {
     sleep2,
     logger
   );
+  const seen = readRevocationSequence(cacheRoot, originUrl);
+  if (seen.warning) {
+    logger.warn(seen.warning);
+  }
+  assertSequenceNotReplayed({
+    originUrl,
+    seen: seen.sequence,
+    incoming: denyList.sequence
+  });
+  writeRevocationSequence(cacheRoot, originUrl, denyList.sequence, now);
   const key = `${reference.name}@${reference.version}`;
-  if (deniedEntries.includes(key)) {
+  if (denyList.entries.includes(key)) {
     const entryDir = cacheEntryPath(cacheRoot, reference);
-    if (fs28.existsSync(entryDir)) {
-      fs28.rmSync(entryDir, { recursive: true, force: true });
+    if (fs29.existsSync(entryDir)) {
+      fs29.rmSync(entryDir, { recursive: true, force: true });
     }
     throw new IntegrityError(
       `"${key}" is present on the signed revocation deny-list \u2014 refusing to materialize or install; any existing cache entry has been invalidated (REQ-INT-009).`
@@ -23453,7 +23586,7 @@ function assertFileWithinCeiling(entryPath, byteLength) {
 }
 var WINDOWS_DRIVE_ABSOLUTE = /^[a-zA-Z]:[\\/]/u;
 function sanitizeBundleFilePath(entryPath, stagingDir) {
-  if (path26.isAbsolute(entryPath) || WINDOWS_DRIVE_ABSOLUTE.test(entryPath)) {
+  if (path27.isAbsolute(entryPath) || WINDOWS_DRIVE_ABSOLUTE.test(entryPath)) {
     throw new IntegrityError(
       `Bundle file path "${entryPath}" is absolute \u2014 every file inside a bundle must use a relative path (REQ-INT-004).`
     );
@@ -23469,13 +23602,13 @@ function sanitizeBundleFilePath(entryPath, stagingDir) {
       `Bundle file path "${entryPath}" contains a ".." segment \u2014 directory traversal is rejected (REQ-INT-004).`
     );
   }
-  const resolved = path26.resolve(stagingDir, entryPath);
+  const resolved = path27.resolve(stagingDir, entryPath);
   if (resolved === stagingDir) {
     throw new IntegrityError(
       `Bundle file path "${entryPath}" resolves to the staging directory itself \u2014 every entry must be a file inside it (REQ-INT-004).`
     );
   }
-  if (!resolved.startsWith(stagingDir + path26.sep)) {
+  if (!resolved.startsWith(stagingDir + path27.sep)) {
     throw new IntegrityError(
       `Bundle file path "${entryPath}" escapes the staging directory \u2014 refusing to write (REQ-INT-004).`
     );
@@ -23527,10 +23660,10 @@ function verifyBundleFileHashes(bundle) {
 function writeStagedFiles(stagingDir, decoded) {
   for (const [rawPath, bytes] of decoded) {
     const target = sanitizeBundleFilePath(rawPath, stagingDir);
-    fs28.mkdirSync(path26.dirname(target), { recursive: true, mode: 448 });
+    fs29.mkdirSync(path27.dirname(target), { recursive: true, mode: 448 });
     let existingStat;
     try {
-      existingStat = fs28.lstatSync(target);
+      existingStat = fs29.lstatSync(target);
     } catch (error) {
       if (error.code !== "ENOENT") {
         throw error;
@@ -23541,7 +23674,7 @@ function writeStagedFiles(stagingDir, decoded) {
         `Refusing to write "${rawPath}" \u2014 a symbolic link already exists at the target path.`
       );
     }
-    fs28.writeFileSync(target, bytes, { mode: 384, flag: "wx" });
+    fs29.writeFileSync(target, bytes, { mode: 384, flag: "wx" });
   }
 }
 function verifyWarmCacheEntry(entryDir, reference, keys, now) {
@@ -23607,14 +23740,14 @@ async function materializeRemoteKit(params) {
     writeStagedFiles(stagingDir, decoded);
     writeBundleDocument(stagingDir, bundle);
     writeCompletionMarker(stagingDir, reference);
-    if (replace && fs28.existsSync(entryDir)) {
-      fs28.rmSync(entryDir, { recursive: true, force: true });
+    if (replace && fs29.existsSync(entryDir)) {
+      fs29.rmSync(entryDir, { recursive: true, force: true });
     }
     publishCacheEntry(stagingDir, entryDir);
     return entryDir;
   } catch (error) {
     if (stagingDir !== void 0) {
-      fs28.rmSync(stagingDir, { recursive: true, force: true });
+      fs29.rmSync(stagingDir, { recursive: true, force: true });
     }
     throw error;
   }
@@ -23822,13 +23955,13 @@ function sleep(ms2) {
 // src/adapters/codex.ts
 var TOML3 = __toESM(require_toml(), 1);
 import crypto5 from "crypto";
-import fs30 from "fs";
-import path29 from "path";
+import fs31 from "fs";
+import path30 from "path";
 
 // src/compiler/agents.ts
 var TOML = __toESM(require_toml(), 1);
 var import_yaml7 = __toESM(require_dist(), 1);
-import path27 from "path";
+import path28 from "path";
 
 // src/compiler/loss-report.ts
 function createLossReport() {
@@ -23892,7 +24025,7 @@ var copilotToolAliasesByClass = {
 };
 function compileAgent(sourceFile, target, mappings, extensions, lossReport) {
   const { data, body } = parseMarkdownFrontmatter(sourceFile);
-  const relativeSource = `agents/${path27.basename(sourceFile)}`;
+  const relativeSource = `agents/${path28.basename(sourceFile)}`;
   if (target === "opencode") {
     return compileOpenCodeAgent(
       sourceFile,
@@ -23933,7 +24066,7 @@ function compileAgent(sourceFile, target, mappings, extensions, lossReport) {
     mappings,
     lossReport
   );
-  const overlayKey = `agents/${path27.basename(sourceFile, ".md")}.${target}.yaml`;
+  const overlayKey = `agents/${path28.basename(sourceFile, ".md")}.${target}.yaml`;
   const targetFields = {
     ...translated.fields,
     ...extensions[overlayKey] ?? {}
@@ -23967,7 +24100,7 @@ ${TOML.stringify({
 function compileOpenCodeAgent(sourceFile, data, body, relativeSource, lossReport) {
   if (typeof data.description !== "string" || data.description.trim() === "") {
     throw new Error(
-      `${path27.basename(sourceFile)}: OpenCode agent requires a non-empty description field`
+      `${path28.basename(sourceFile)}: OpenCode agent requires a non-empty description field`
     );
   }
   const frontmatter = {
@@ -24021,7 +24154,7 @@ function compileOpenCodeAgent(sourceFile, data, body, relativeSource, lossReport
                 "permission",
                 "permission-coarsening"
               ),
-              detail: `${path27.basename(sourceFile)}: per-tool permission '${tool}' mapped to coarse allow|deny action`
+              detail: `${path28.basename(sourceFile)}: per-tool permission '${tool}' mapped to coarse allow|deny action`
             }
           ]
         });
@@ -24046,7 +24179,7 @@ ${(0, import_yaml7.stringify)(frontmatter).trim()}
 function compileCursorAgent(sourceFile, data, body, relativeSource, lossReport) {
   if (typeof data.description !== "string" || data.description.trim() === "") {
     throw new Error(
-      `${path27.basename(sourceFile)}: Cursor agent requires a non-empty description field`
+      `${path28.basename(sourceFile)}: Cursor agent requires a non-empty description field`
     );
   }
   const frontmatter = {
@@ -24083,7 +24216,7 @@ function compileCursorAgent(sourceFile, data, body, relativeSource, lossReport)
             "permission",
             "permission-coarsening"
           ),
-          detail: `${path27.basename(sourceFile)}: per-agent tool allow set coarsened to readonly=${readonly} boolean (Cursor only exposes readonly control)`
+          detail: `${path28.basename(sourceFile)}: per-agent tool allow set coarsened to readonly=${readonly} boolean (Cursor only exposes readonly control)`
         }
       ]
     });
@@ -24102,7 +24235,7 @@ function compileCursorAgent(sourceFile, data, body, relativeSource, lossReport)
             "provider",
             "provider-not-representable"
           ),
-          detail: `${path27.basename(sourceFile)}: custom provider cannot be expressed in Cursor subagent frontmatter \u2014 configure manually via Cursor settings`
+          detail: `${path28.basename(sourceFile)}: custom provider cannot be expressed in Cursor subagent frontmatter \u2014 configure manually via Cursor settings`
         }
       ]
     });
@@ -24134,7 +24267,7 @@ function compileClineAgent(sourceFile, _data, _body, relativeSource, lossReport)
           "persona",
           "persona-not-representable"
         ),
-        detail: `${path27.basename(sourceFile)}: Cline has no committable per-agent persona file for the VSCode extension target; configure the agent through Cline Settings \u2192 Agent.`
+        detail: `${path28.basename(sourceFile)}: Cline has no committable per-agent persona file for the VSCode extension target; configure the agent through Cline Settings \u2192 Agent.`
       }
     ]
   });
@@ -24182,7 +24315,7 @@ function applyFieldAction(sourceFile, field, value, action, target, mappings, tr
           field,
           "model-not-representable"
         ),
-        detail: `${path27.basename(sourceFile)}: model tier '${String(value)}' has no stable Copilot model literal; omitted so VS Code uses the selected model.`
+        detail: `${path28.basename(sourceFile)}: model tier '${String(value)}' has no stable Copilot model literal; omitted so VS Code uses the selected model.`
       });
       return;
     }
@@ -24200,9 +24333,9 @@ function applyFieldAction(sourceFile, field, value, action, target, mappings, tr
       lossReport,
       target,
       "agents",
-      `agents/${path27.basename(sourceFile)}`,
+      `agents/${path28.basename(sourceFile)}`,
       "info",
-      `${path27.basename(sourceFile)}: ${field} is delivered through another managed surface.`
+      `${path28.basename(sourceFile)}: ${field} is delivered through another managed surface.`
     );
     return;
   }
@@ -24211,7 +24344,7 @@ function applyFieldAction(sourceFile, field, value, action, target, mappings, tr
     field,
     action: entryType,
     severity: resolveLossSeverity("agent-field", field, entryType),
-    detail: `${path27.basename(sourceFile)}: ${field} has no emitted field for this target.`
+    detail: `${path28.basename(sourceFile)}: ${field} has no emitted field for this target.`
   });
 }
 function mapToolsToCapabilities(value, mappings) {
@@ -24808,9 +24941,9 @@ function compileOpenCodeMcp(sourceMcpJson, lossReport, sourceLabel) {
 }
 
 // src/compiler/rules.ts
-import path28 from "path";
+import path29 from "path";
 var import_yaml8 = __toESM(require_dist(), 1);
-import fs29 from "fs";
+import fs30 from "fs";
 function compileRules(sourceRulesDir, target, _mappings, lossReport) {
   if (target === "copilot") {
     addLoss(lossReport, "copilot", "rules", {
@@ -24847,13 +24980,13 @@ function compileRules(sourceRulesDir, target, _mappings, lossReport) {
   }
   const appendixParts = [];
   const dotRulesFiles = [];
-  for (const ruleFile of ts(path28.join(sourceRulesDir, "*.md")).sort()) {
+  for (const ruleFile of ts(path29.join(sourceRulesDir, "*.md")).sort()) {
     const parsed = parseRule(ruleFile);
-    const name = path28.basename(ruleFile, ".md");
+    const name = path29.basename(ruleFile, ".md");
     if (parsed.mode === "exec-policy") {
       dotRulesFiles.push({
         name: `${name}.rules`,
-        content: `${formatProvenanceMarker("toml", `rules/${path28.basename(ruleFile)}`, computeSourceHash(ruleFile), "codex")}
+        content: `${formatProvenanceMarker("toml", `rules/${path29.basename(ruleFile)}`, computeSourceHash(ruleFile), "codex")}
 ${parsed.body}`
       });
       continue;
@@ -24862,7 +24995,7 @@ ${parsed.body}`
 
 ${parsed.body.trim()}`);
     addLoss(lossReport, "codex", "rules", {
-      source: `rules/${path28.basename(ruleFile)}`,
+      source: `rules/${path29.basename(ruleFile)}`,
       fields: [
         {
           field: "mode",
@@ -24872,7 +25005,7 @@ ${parsed.body.trim()}`);
             "mode",
             "rule-as-instruction"
           ),
-          detail: `${path28.basename(ruleFile)} is appended to the managed Codex instructions file as guidance.`
+          detail: `${path29.basename(ruleFile)} is appended to the managed Codex instructions file as guidance.`
         }
       ]
     });
@@ -24880,7 +25013,7 @@ ${parsed.body.trim()}`);
   return { agentsAppendix: appendixParts.join("\n\n"), dotRulesFiles };
 }
 function parseRule(ruleFile) {
-  const content = fs29.readFileSync(ruleFile, "utf8");
+  const content = fs30.readFileSync(ruleFile, "utf8");
   if (!content.startsWith("---\n")) {
     return { mode: "guidance", body: content };
   }
@@ -24904,14 +25037,14 @@ function isRuleMode(value) {
 }
 function compileOpenCodeRules(sourceRulesDir, lossReport) {
   const appendixParts = [];
-  for (const ruleFile of ts(path28.join(sourceRulesDir, "*.md")).sort()) {
+  for (const ruleFile of ts(path29.join(sourceRulesDir, "*.md")).sort()) {
     const parsed = parseRule(ruleFile);
-    const name = path28.basename(ruleFile, ".md");
+    const name = path29.basename(ruleFile, ".md");
     appendixParts.push(`## ${name}
 
 ${parsed.body.trim()}`);
     addLoss(lossReport, "opencode", "rules", {
-      source: `rules/${path28.basename(ruleFile)}`,
+      source: `rules/${path29.basename(ruleFile)}`,
       fields: [
         {
           field: "rule",
@@ -24921,7 +25054,7 @@ ${parsed.body.trim()}`);
             "rule",
             "rule-path-scoping"
           ),
-          detail: `${path28.basename(ruleFile)}: OpenCode has no per-agent rule scoping \u2014 rule appended to AGENTS.md instructions`
+          detail: `${path29.basename(ruleFile)}: OpenCode has no per-agent rule scoping \u2014 rule appended to AGENTS.md instructions`
         }
       ]
     });
@@ -24930,9 +25063,9 @@ ${parsed.body.trim()}`);
 }
 function compileCursorRules(sourceRulesDir, _lossReport) {
   const dotRulesFiles = [];
-  for (const ruleFile of ts(path28.join(sourceRulesDir, "*.md")).sort()) {
-    const content = fs29.readFileSync(ruleFile, "utf8");
-    const name = path28.basename(ruleFile, ".md");
+  for (const ruleFile of ts(path29.join(sourceRulesDir, "*.md")).sort()) {
+    const content = fs30.readFileSync(ruleFile, "utf8");
+    const name = path29.basename(ruleFile, ".md");
     let frontmatterData = {};
     let body = content;
     if (content.startsWith("---\n")) {
@@ -24961,7 +25094,7 @@ function compileCursorRules(sourceRulesDir, _lossReport) {
     }
     const marker = formatProvenanceMarker(
       "markdown",
-      `rules/${path28.basename(ruleFile)}`,
+      `rules/${path29.basename(ruleFile)}`,
       computeSourceHash(ruleFile),
       "cursor"
     );
@@ -24977,9 +25110,9 @@ ${body}`;
 }
 function compileClineRules(sourceRulesDir, lossReport) {
   const dotRulesFiles = [];
-  for (const ruleFile of ts(path28.join(sourceRulesDir, "*.md")).sort()) {
-    const content = fs29.readFileSync(ruleFile, "utf8");
-    const name = path28.basename(ruleFile, ".md");
+  for (const ruleFile of ts(path29.join(sourceRulesDir, "*.md")).sort()) {
+    const content = fs30.readFileSync(ruleFile, "utf8");
+    const name = path29.basename(ruleFile, ".md");
     let frontmatterData = {};
     let body = content;
     if (content.startsWith("---\n")) {
@@ -24996,13 +25129,13 @@ function compileClineRules(sourceRulesDir, lossReport) {
     }
     const marker = formatProvenanceMarker(
       "markdown",
-      `rules/${path28.basename(ruleFile)}`,
+      `rules/${path29.basename(ruleFile)}`,
       computeSourceHash(ruleFile),
       "cline"
     );
     if (frontmatterData.mode === "exec-policy") {
       addLoss(lossReport, "cline", "rules", {
-        source: `rules/${path28.basename(ruleFile)}`,
+        source: `rules/${path29.basename(ruleFile)}`,
         fields: [
           {
             field: "mode",
@@ -25012,7 +25145,7 @@ function compileClineRules(sourceRulesDir, lossReport) {
               "mode",
               "rule-mode-downgrade"
             ),
-            detail: `${path28.basename(ruleFile)}: Cline rules have no exec-policy mode; rule emitted as guidance.`
+            detail: `${path29.basename(ruleFile)}: Cline rules have no exec-policy mode; rule emitted as guidance.`
           }
         ]
       });
@@ -25057,7 +25190,7 @@ function syncCodex(config, sourceRoot, mappings, extensions, options, lossReport
     rules: profile.rules
   };
   const rules = compileRules(
-    path29.join(sourceRoot, config.source.rules),
+    path30.join(sourceRoot, config.source.rules),
     "codex",
     mappings,
     lossReport
@@ -25202,9 +25335,9 @@ function syncCodex(config, sourceRoot, mappings, extensions, options, lossReport
 function buildProviderTomlSection(config, sourceRoot, mappings, scope, lossReport) {
   const cp = mappings.modelTiers.custom_provider;
   if (!cp) return "";
-  const agentsDir = path29.join(sourceRoot, config.source.agents);
-  if (!fs30.existsSync(agentsDir)) return "";
-  const agentFiles = ts(path29.join(agentsDir, "*.md")).sort();
+  const agentsDir = path30.join(sourceRoot, config.source.agents);
+  if (!fs31.existsSync(agentsDir)) return "";
+  const agentFiles = ts(path30.join(agentsDir, "*.md")).sort();
   const hasProviderAgent = agentFiles.some((agentFile) => {
     const { data } = parseMarkdownFrontmatter(agentFile);
     return typeof data.provider === "string" || typeof data.provider === "object" && data.provider !== null && Object.keys(data.provider).length > 0;
@@ -25269,7 +25402,7 @@ function syncRules(config, sourceRoot, paths, rules, options, logger, manifest,
     }
   ];
   for (const ruleFile of rules.dotRulesFiles) {
-    const destination = path29.join(rulesRoot, ruleFile.name);
+    const destination = path30.join(rulesRoot, ruleFile.name);
     if (options.dryRun) {
       logger.info(`[dry-run] rules: write ${destination}`);
       outcomes.push({
@@ -25297,15 +25430,15 @@ function syncRules(config, sourceRoot, paths, rules, options, logger, manifest,
   return outcomes;
 }
 function syncInstructions(config, sourceRoot, paths, agentsAppendix, options, logger, manifest, scopePath) {
-  const source = path29.join(sourceRoot, config.source.instructions);
+  const source = path30.join(sourceRoot, config.source.instructions);
   const destination = resolveTargetPath(paths.instructions);
-  const composed = `${fs30.readFileSync(source, "utf8").trim()}
+  const composed = `${fs31.readFileSync(source, "utf8").trim()}
 
 --- tangyr managed rules ---
 ${agentsAppendix}`.trim();
   const marker = formatProvenanceMarker(
     "markdown",
-    path29.basename(config.source.instructions),
+    path30.basename(config.source.instructions),
     hashString(composed),
     "codex"
   );
@@ -25332,9 +25465,9 @@ ${composed}
   );
 }
 function syncSkills(config, sourceRoot, paths, options, logger, manifest, scopePath) {
-  const source = path29.resolve(sourceRoot, config.source.skills);
+  const source = path30.resolve(sourceRoot, config.source.skills);
   const destination = resolveTargetPath(paths.skills);
-  if (!fs30.existsSync(source)) {
+  if (!fs31.existsSync(source)) {
     return skippedMissingSource("skills", source);
   }
   if (options.dryRun) {
@@ -25350,29 +25483,29 @@ function syncSkills(config, sourceRoot, paths, options, logger, manifest, scopeP
     };
   }
   if (artifactClass === "managed-stale" && isOurStaleSymlink(destination, /* @__PURE__ */ new Set([destination]), config)) {
-    fs30.unlinkSync(destination);
+    fs31.unlinkSync(destination);
     logger.verbose(`Skills: created skills path ${destination}`);
   } else if (artifactClass === "unmanaged-conflict" && !handleConflict(destination, config, options, logger, manifest, scopePath)) {
     return { component: "skills", status: "conflict", path: destination };
   } else if (artifactClass === "managed-symlink") {
-    fs30.unlinkSync(destination);
+    fs31.unlinkSync(destination);
   }
-  ensureDir(path29.dirname(destination));
+  ensureDir(path30.dirname(destination));
   createRelativeSymlink(source, destination, "dir");
   logger.verbose(`Skills: created skills path ${destination}`);
   return { component: "skills", status: "success", path: destination };
 }
 function syncAgents(config, sourceRoot, paths, mappings, extensions, options, lossReport, logger, manifest, scopePath) {
-  const sourceAgentsRoot = path29.join(sourceRoot, config.source.agents);
-  if (!fs30.existsSync(sourceAgentsRoot)) {
+  const sourceAgentsRoot = path30.join(sourceRoot, config.source.agents);
+  if (!fs31.existsSync(sourceAgentsRoot)) {
     return [skippedMissingSource("agents", sourceAgentsRoot)];
   }
-  const sourceAgents = ts(path29.join(sourceAgentsRoot, "*.md")).sort();
+  const sourceAgents = ts(path30.join(sourceAgentsRoot, "*.md")).sort();
   const agentsRoot = resolveTargetPath(paths.agents);
   return sourceAgents.map((agentFile) => {
-    const destination = path29.join(
+    const destination = path30.join(
       agentsRoot,
-      `${path29.basename(agentFile, ".md")}.toml`
+      `${path30.basename(agentFile, ".md")}.toml`
     );
     const compiled = compileAgent(
       agentFile,
@@ -25408,10 +25541,10 @@ function syncHooks(config, sourceRoot, paths, mappings, options, lossReport, log
   }
   const source = resolveHooksSourceFile(sourceRoot, config);
   const sourceLabel = hooksSourceLabel(config);
-  if (!fs30.existsSync(source)) {
+  if (!fs31.existsSync(source)) {
     return skippedMissingSource("hooks", source);
   }
-  const sourceHooksJson = JSON.parse(fs30.readFileSync(source, "utf8"));
+  const sourceHooksJson = JSON.parse(fs31.readFileSync(source, "utf8"));
   const compiled = compileHooks(
     sourceHooksJson,
     "codex",
@@ -25433,7 +25566,7 @@ function syncHooks(config, sourceRoot, paths, mappings, options, lossReport, log
     destination,
     hostHooks,
     stringifyJson2,
-    !fs30.existsSync(destination),
+    !fs31.existsSync(destination),
     logger
   );
   return {
@@ -25446,7 +25579,7 @@ function syncMcp(config, sourceRoot, paths, options, lossReport, logger, provide
   const source = resolveMcpSourceFile(sourceRoot, config);
   const sourceLabel = mcpSourceLabel(config);
   const destination = resolveTargetPath(paths.mcp_shared_file);
-  if (!fs30.existsSync(source)) {
+  if (!fs31.existsSync(source)) {
     if (providerToml && !options.dryRun) {
       const changed2 = writeTomlManagedSection(
         destination,
@@ -25461,7 +25594,7 @@ function syncMcp(config, sourceRoot, paths, options, lossReport, logger, provide
     }
     return skippedMissingSource("mcp", source);
   }
-  const sourceMcpJson = JSON.parse(fs30.readFileSync(source, "utf8"));
+  const sourceMcpJson = JSON.parse(fs31.readFileSync(source, "utf8"));
   const compiled = compileMcp(sourceMcpJson, "codex", lossReport, sourceLabel);
   const managedContent = providerToml ? `${compiled.trimEnd()}${providerToml}` : compiled;
   if (options.dryRun) {
@@ -25483,12 +25616,12 @@ function writeCompiledArtifact(component, destination, content, expectedHash, co
   if (artifactClass === "unmanaged-conflict" && !handleConflict(destination, config, options, logger, manifest, scopePath)) {
     return { component, status: "conflict", path: destination };
   }
-  ensureDir(path29.dirname(destination));
-  fs30.writeFileSync(destination, content);
+  ensureDir(path30.dirname(destination));
+  fs31.writeFileSync(destination, content);
   return { component, status: "success", path: destination };
 }
 function writeTomlManagedSection(destination, managedContent, logger) {
-  const current = fs30.existsSync(destination) ? fs30.readFileSync(destination, "utf8") : "";
+  const current = fs31.existsSync(destination) ? fs31.readFileSync(destination, "utf8") : "";
   const isFirstWrite = current.length > 0 && !current.includes(managedMcpStart);
   if (isFirstWrite) {
     logger.warn(
@@ -25504,8 +25637,8 @@ ${managedMcpEnd}
   if (current === next.trimStart()) {
     return false;
   }
-  ensureDir(path29.dirname(destination));
-  fs30.writeFileSync(destination, next.trimStart());
+  ensureDir(path30.dirname(destination));
+  fs31.writeFileSync(destination, next.trimStart());
   return true;
 }
 function removeManagedTomlSection(content) {
@@ -25532,16 +25665,16 @@ function handleConflict(destination, config, options, logger, manifest, scopePat
       backupFile(destination, manifest);
       writeManifest(scopePath, manifest);
     } else {
-      fs30.renameSync(destination, `${destination}.bak.${Date.now()}`);
+      fs31.renameSync(destination, `${destination}.bak.${Date.now()}`);
     }
     return true;
   }
-  fs30.rmSync(destination, { recursive: true, force: true });
+  fs31.rmSync(destination, { recursive: true, force: true });
   return true;
 }
 function isCompiledCurrent(destination, expectedContent, expectedHash) {
   try {
-    const current = fs30.readFileSync(destination, "utf8");
+    const current = fs31.readFileSync(destination, "utf8");
     const marker = extractProvenanceMarker(current);
     return expectedHash ? marker?.hash === expectedHash && marker.target === "codex" && current === expectedContent : current === expectedContent;
   } catch {
@@ -25560,16 +25693,16 @@ function shouldSkipComponent(options, component) {
 }
 function isSymlinkTo(linkPath, source) {
   try {
-    return fs30.realpathSync(linkPath) === fs30.realpathSync(source);
+    return fs31.realpathSync(linkPath) === fs31.realpathSync(source);
   } catch {
     return false;
   }
 }
 function readJsonObject3(filePath) {
-  if (!fs30.existsSync(filePath)) {
+  if (!fs31.existsSync(filePath)) {
     return {};
   }
-  const parsed = JSON.parse(fs30.readFileSync(filePath, "utf8"));
+  const parsed = JSON.parse(fs31.readFileSync(filePath, "utf8"));
   return isRecord4(parsed) ? parsed : {};
 }
 function stringifyJson2(value) {
@@ -25585,16 +25718,16 @@ function hashString(value) {
 
 // src/adapters/copilot.ts
 import crypto6 from "crypto";
-import fs31 from "fs";
-import path31 from "path";
+import fs32 from "fs";
+import path32 from "path";
 
 // src/compiler/commands.ts
 var import_yaml9 = __toESM(require_dist(), 1);
-import path30 from "path";
+import path31 from "path";
 function compileCommandPrompt(sourceFile) {
   const { data, body } = parseMarkdownFrontmatter(sourceFile);
-  const relativeSource = `commands/${path30.basename(sourceFile)}`;
-  const fields = promptFrontmatter(data, path30.basename(sourceFile, ".md"));
+  const relativeSource = `commands/${path31.basename(sourceFile)}`;
+  const fields = promptFrontmatter(data, path31.basename(sourceFile, ".md"));
   const marker = formatProvenanceMarker(
     "markdown",
     relativeSource,
@@ -25769,13 +25902,13 @@ function syncCopilot(config, sourceRoot, mappings, extensions, options, lossRepo
 }
 function syncProviderLoss(config, sourceRoot, mappings, lossReport) {
   if (!mappings.modelTiers.custom_provider) return;
-  const agentsDir = path31.join(sourceRoot, config.source.agents);
-  if (!fs31.existsSync(agentsDir)) return;
-  for (const agentFile of ts(path31.join(agentsDir, "*.md")).sort()) {
+  const agentsDir = path32.join(sourceRoot, config.source.agents);
+  if (!fs32.existsSync(agentsDir)) return;
+  for (const agentFile of ts(path32.join(agentsDir, "*.md")).sort()) {
     const { data } = parseMarkdownFrontmatter(agentFile);
     const hasProvider = typeof data.provider === "string" || typeof data.provider === "object" && data.provider !== null && Object.keys(data.provider).length > 0;
     if (hasProvider) {
-      const basename = path31.basename(agentFile);
+      const basename = path32.basename(agentFile);
       addLoss(lossReport, "copilot", "agents", {
         source: `agents/${basename}`,
         fields: [
@@ -25800,23 +25933,23 @@ function syncCopilotInstructions(config, sourceRoot, options, lossReport, logger
     logger.verbose(message);
     return [{ component: "instructions", status: "skipped", path: message }];
   }
-  const source = path31.resolve(sourceRoot, config.source.instructions);
-  if (!fs31.existsSync(source)) {
+  const source = path32.resolve(sourceRoot, config.source.instructions);
+  if (!fs32.existsSync(source)) {
     return [skippedMissingSource2("instructions", source)];
   }
-  const rawContent = fs31.readFileSync(source, "utf8");
+  const rawContent = fs32.readFileSync(source, "utf8");
   const contentHash = hashString2(rawContent);
   const marker = formatProvenanceMarker(
     "markdown",
-    path31.basename(config.source.instructions),
+    path32.basename(config.source.instructions),
     contentHash,
     "copilot"
   );
   const composedContent = `${marker}
 ${rawContent}`;
   const projectRoot = options.projectRoot ?? process.cwd();
-  const agentsMdDest = path31.resolve(projectRoot, "AGENTS.md");
-  const mirrorDest = path31.resolve(
+  const agentsMdDest = path32.resolve(projectRoot, "AGENTS.md");
+  const mirrorDest = path32.resolve(
     projectRoot,
     ".github",
     "copilot-instructions.md"
@@ -25870,17 +26003,17 @@ function writeInstructionsFile(component, destination, content, contentHash, con
   if (artifactClass === "unmanaged-conflict" && !handleConflict2(destination, config, options, logger, manifest, scopePath)) {
     return { component, status: "conflict", path: destination };
   }
-  ensureDir(path31.dirname(destination));
-  fs31.writeFileSync(destination, content);
+  ensureDir(path32.dirname(destination));
+  fs32.writeFileSync(destination, content);
   return { component, status: "success", path: destination };
 }
 function hashString2(value) {
   return `sha256:${crypto6.createHash("sha256").update(value).digest("hex")}`;
 }
 function syncSkills2(config, sourceRoot, paths, options, logger, manifest, scopePath) {
-  const source = path31.resolve(sourceRoot, config.source.skills);
+  const source = path32.resolve(sourceRoot, config.source.skills);
   const destination = resolveTargetPath(paths.skills);
-  if (!fs31.existsSync(source)) {
+  if (!fs32.existsSync(source)) {
     return skippedMissingSource2("skills", source);
   }
   if (options.dryRun) {
@@ -25896,27 +26029,27 @@ function syncSkills2(config, sourceRoot, paths, options, logger, manifest, scope
     };
   }
   if (artifactClass === "managed-stale" && isOurStaleSymlink(destination, /* @__PURE__ */ new Set([destination]), config)) {
-    fs31.unlinkSync(destination);
+    fs32.unlinkSync(destination);
   } else if (artifactClass === "unmanaged-conflict" && !handleConflict2(destination, config, options, logger, manifest, scopePath)) {
     return { component: "skills", status: "conflict", path: destination };
   } else if (artifactClass === "managed-symlink") {
-    fs31.unlinkSync(destination);
+    fs32.unlinkSync(destination);
   }
-  ensureDir(path31.dirname(destination));
+  ensureDir(path32.dirname(destination));
   createRelativeSymlink(source, destination, "dir");
   return { component: "skills", status: "success", path: destination };
 }
 function syncAgents2(config, sourceRoot, paths, mappings, extensions, options, lossReport, logger, manifest, scopePath) {
-  const sourceAgentsRoot = path31.join(sourceRoot, config.source.agents);
-  if (!fs31.existsSync(sourceAgentsRoot)) {
+  const sourceAgentsRoot = path32.join(sourceRoot, config.source.agents);
+  if (!fs32.existsSync(sourceAgentsRoot)) {
     return [skippedMissingSource2("agents", sourceAgentsRoot)];
   }
-  const sourceAgents = ts(path31.join(sourceAgentsRoot, "*.md")).sort();
+  const sourceAgents = ts(path32.join(sourceAgentsRoot, "*.md")).sort();
   const agentsRoot = resolveTargetPath(paths.agents);
   return sourceAgents.map((agentFile) => {
-    const destination = path31.join(
+    const destination = path32.join(
       agentsRoot,
-      `${path31.basename(agentFile, ".md")}.agent.md`
+      `${path32.basename(agentFile, ".md")}.agent.md`
     );
     const compiled = compileAgent(
       agentFile,
@@ -25944,16 +26077,16 @@ function syncAgents2(config, sourceRoot, paths, mappings, extensions, options, l
   });
 }
 function syncCommands(config, sourceRoot, paths, options, logger, manifest, scopePath) {
-  const sourceCommandsRoot = path31.join(sourceRoot, config.source.commands);
-  if (!fs31.existsSync(sourceCommandsRoot)) {
+  const sourceCommandsRoot = path32.join(sourceRoot, config.source.commands);
+  if (!fs32.existsSync(sourceCommandsRoot)) {
     return [skippedMissingSource2("commands", sourceCommandsRoot)];
   }
-  const sourceCommands = ts(path31.join(sourceCommandsRoot, "*.md")).sort();
+  const sourceCommands = ts(path32.join(sourceCommandsRoot, "*.md")).sort();
   const promptsRoot = resolveTargetPath(paths.prompts);
   return sourceCommands.map((commandFile) => {
-    const destination = path31.join(
+    const destination = path32.join(
       promptsRoot,
-      `${path31.basename(commandFile, ".md")}.prompt.md`
+      `${path32.basename(commandFile, ".md")}.prompt.md`
     );
     const compiled = compileCommandPrompt(commandFile);
     if (options.dryRun) {
@@ -25979,14 +26112,14 @@ function syncCommands(config, sourceRoot, paths, options, logger, manifest, scop
 function syncHooks2(config, sourceRoot, paths, mappings, options, lossReport, logger) {
   const source = resolveHooksSourceFile(sourceRoot, config);
   const sourceLabel = hooksSourceLabel(config);
-  const destination = path31.join(
+  const destination = path32.join(
     resolveTargetPath(paths.hooks),
     "tangyr-managed.json"
   );
-  if (!fs31.existsSync(source)) {
+  if (!fs32.existsSync(source)) {
     return skippedMissingSource2("hooks", source);
   }
-  const sourceHooksJson = JSON.parse(fs31.readFileSync(source, "utf8"));
+  const sourceHooksJson = JSON.parse(fs32.readFileSync(source, "utf8"));
   const compiled = compileHooks(
     sourceHooksJson,
     "copilot",
@@ -26023,10 +26156,10 @@ function syncMcp2(config, sourceRoot, paths, options, lossReport, logger) {
   const source = resolveMcpSourceFile(sourceRoot, config);
   const sourceLabel = mcpSourceLabel(config);
   const destination = resolveTargetPath(paths.mcp_shared_file);
-  if (!fs31.existsSync(source)) {
+  if (!fs32.existsSync(source)) {
     return skippedMissingSource2("mcp", source);
   }
-  const sourceMcpJson = JSON.parse(fs31.readFileSync(source, "utf8"));
+  const sourceMcpJson = JSON.parse(fs32.readFileSync(source, "utf8"));
   const compiled = compileMcp(
     sourceMcpJson,
     "copilot",
@@ -26056,13 +26189,13 @@ function writeCompiledArtifact2(component, destination, content, expectedHash, c
   if (artifactClass === "unmanaged-conflict" && !handleConflict2(destination, config, options, logger, manifest, scopePath)) {
     return { component, status: "conflict", path: destination };
   }
-  ensureDir(path31.dirname(destination));
-  fs31.writeFileSync(destination, content);
+  ensureDir(path32.dirname(destination));
+  fs32.writeFileSync(destination, content);
   return { component, status: "success", path: destination };
 }
 function isCompiledCurrent2(destination, expectedContent, expectedHash) {
   try {
-    const current = fs31.readFileSync(destination, "utf8");
+    const current = fs32.readFileSync(destination, "utf8");
     const marker = extractProvenanceMarker(current);
     return expectedHash ? marker?.hash === expectedHash && marker.target === "copilot" && current === expectedContent : current === expectedContent;
   } catch {
@@ -26085,11 +26218,11 @@ function handleConflict2(destination, config, options, logger, manifest, scopePa
       backupFile(destination, manifest);
       writeManifest(scopePath, manifest);
     } else {
-      fs31.renameSync(destination, `${destination}.bak.${Date.now()}`);
+      fs32.renameSync(destination, `${destination}.bak.${Date.now()}`);
     }
     return true;
   }
-  fs31.rmSync(destination, { recursive: true, force: true });
+  fs32.rmSync(destination, { recursive: true, force: true });
   return true;
 }
 function shouldSkipComponent2(options, component) {
@@ -26098,12 +26231,12 @@ function shouldSkipComponent2(options, component) {
 function cleanupLegacyAgents(paths, options, logger) {
   const currentAgentsRoot = resolveTargetPath(paths.agents);
   const legacyAgentsRoot = resolveTargetPath(legacyCopilotAgentsPath);
-  if (path31.resolve(currentAgentsRoot) === path31.resolve(legacyAgentsRoot)) {
+  if (path32.resolve(currentAgentsRoot) === path32.resolve(legacyAgentsRoot)) {
     return [];
   }
   const outcomes = [];
   for (const filePath of ts(
-    path31.join(legacyAgentsRoot, "*.agent.md")
+    path32.join(legacyAgentsRoot, "*.agent.md")
   ).sort()) {
     if (!isCopilotManagedCompiledFile(filePath)) {
       continue;
@@ -26113,14 +26246,14 @@ function cleanupLegacyAgents(paths, options, logger) {
       outcomes.push({ component: "agents", status: "dry-run", path: filePath });
       continue;
     }
-    fs31.rmSync(filePath, { force: true });
+    fs32.rmSync(filePath, { force: true });
     outcomes.push({ component: "agents", status: "success", path: filePath });
   }
   return outcomes;
 }
 function isCopilotManagedCompiledFile(filePath) {
   try {
-    return extractProvenanceMarker(fs31.readFileSync(filePath, "utf8"))?.target === "copilot";
+    return extractProvenanceMarker(fs32.readFileSync(filePath, "utf8"))?.target === "copilot";
   } catch {
     return false;
   }
@@ -26134,7 +26267,7 @@ function skippedMissingSource2(component, source) {
 }
 function isSymlinkTo2(linkPath, source) {
   try {
-    return fs31.realpathSync(linkPath) === fs31.realpathSync(source);
+    return fs32.realpathSync(linkPath) === fs32.realpathSync(source);
   } catch {
     return false;
   }
@@ -26142,8 +26275,8 @@ function isSymlinkTo2(linkPath, source) {
 
 // src/adapters/cursor.ts
 import crypto7 from "crypto";
-import fs32 from "fs";
-import path32 from "path";
+import fs33 from "fs";
+import path33 from "path";
 function syncCursor(config, sourceRoot, mappings, extensions, options, lossReport, logger, manifest, scopePath) {
   const scope = options.scope ?? "global";
   const profile = resolveTargetPaths({
@@ -26294,9 +26427,9 @@ function syncCursor(config, sourceRoot, mappings, extensions, options, lossRepor
   return { target: "cursor", outcomes };
 }
 function syncInstructions2(config, sourceRoot, paths, options, lossReport, logger, manifest, scopePath) {
-  const source = path32.join(sourceRoot, config.source.instructions);
+  const source = path33.join(sourceRoot, config.source.instructions);
   const destination = resolveTargetPath(paths.instructions);
-  const baseContent = fs32.existsSync(source) ? fs32.readFileSync(source, "utf8").trim() : "";
+  const baseContent = fs33.existsSync(source) ? fs33.readFileSync(source, "utf8").trim() : "";
   const personaContent = extractPrimaryPersonaContent(
     config,
     sourceRoot,
@@ -26309,7 +26442,7 @@ function syncInstructions2(config, sourceRoot, paths, options, lossReport, logge
 ${personaContent}`.trim() : baseContent;
   const marker = formatProvenanceMarker(
     "markdown",
-    path32.basename(config.source.instructions),
+    path33.basename(config.source.instructions),
     hashString3(composed),
     "cursor"
   );
@@ -26334,11 +26467,11 @@ ${composed}
   );
 }
 function extractPrimaryPersonaContent(config, sourceRoot, lossReport) {
-  const agentsDir = path32.join(sourceRoot, config.source.agents);
-  if (!fs32.existsSync(agentsDir)) {
+  const agentsDir = path33.join(sourceRoot, config.source.agents);
+  if (!fs33.existsSync(agentsDir)) {
     return null;
   }
-  const agentFiles = ts(path32.join(agentsDir, "*.md")).sort();
+  const agentFiles = ts(path33.join(agentsDir, "*.md")).sort();
   if (agentFiles.length === 0) {
     return null;
   }
@@ -26361,7 +26494,7 @@ function extractPrimaryPersonaContent(config, sourceRoot, lossReport) {
     return null;
   }
   addLoss(lossReport, "cursor", "instructions", {
-    source: `agents/${path32.basename(primaryFile)}`,
+    source: `agents/${path33.basename(primaryFile)}`,
     fields: [
       {
         field: "persona",
@@ -26371,23 +26504,23 @@ function extractPrimaryPersonaContent(config, sourceRoot, lossReport) {
           "persona",
           "instructions-shim"
         ),
-        detail: `Primary persona from ${path32.basename(primaryFile)} folded into AGENTS.md (Cursor has no custom modes surface)`
+        detail: `Primary persona from ${path33.basename(primaryFile)} folded into AGENTS.md (Cursor has no custom modes surface)`
       }
     ]
   });
   return body.trim();
 }
 function syncAgents3(config, sourceRoot, paths, mappings, extensions, options, lossReport, logger, manifest, scopePath) {
-  const sourceAgentsRoot = path32.join(sourceRoot, config.source.agents);
-  if (!fs32.existsSync(sourceAgentsRoot)) {
+  const sourceAgentsRoot = path33.join(sourceRoot, config.source.agents);
+  if (!fs33.existsSync(sourceAgentsRoot)) {
     return [skippedMissingSource3("agents", sourceAgentsRoot)];
   }
-  const sourceAgents = ts(path32.join(sourceAgentsRoot, "*.md")).sort();
+  const sourceAgents = ts(path33.join(sourceAgentsRoot, "*.md")).sort();
   const agentsRoot = resolveTargetPath(paths.agents);
   return sourceAgents.map((agentFile) => {
-    const destination = path32.join(
+    const destination = path33.join(
       agentsRoot,
-      `${path32.basename(agentFile, ".md")}.md`
+      `${path33.basename(agentFile, ".md")}.md`
     );
     let compiled;
     try {
@@ -26428,14 +26561,14 @@ function syncAgents3(config, sourceRoot, paths, mappings, extensions, options, l
   });
 }
 function syncRules2(config, sourceRoot, paths, mappings, options, lossReport, logger, manifest, scopePath) {
-  const sourceRulesDir = path32.join(sourceRoot, config.source.rules);
-  if (!fs32.existsSync(sourceRulesDir)) {
+  const sourceRulesDir = path33.join(sourceRoot, config.source.rules);
+  if (!fs33.existsSync(sourceRulesDir)) {
     return [skippedMissingSource3("rules", sourceRulesDir)];
   }
   const compiled = compileRules(sourceRulesDir, "cursor", mappings, lossReport);
   const rulesDir = resolveTargetPath(paths.rules);
   return compiled.dotRulesFiles.map(({ name, content }) => {
-    const destination = path32.join(rulesDir, name);
+    const destination = path33.join(rulesDir, name);
     if (options.dryRun) {
       logger.info(`[dry-run] rules: write ${destination}`);
       return {
@@ -26459,17 +26592,17 @@ function syncRules2(config, sourceRoot, paths, mappings, options, lossReport, lo
   });
 }
 function syncCommands2(config, sourceRoot, paths, options, logger, manifest, scopePath) {
-  const sourceCommandsRoot = path32.join(sourceRoot, config.source.commands);
-  if (!fs32.existsSync(sourceCommandsRoot)) {
+  const sourceCommandsRoot = path33.join(sourceRoot, config.source.commands);
+  if (!fs33.existsSync(sourceCommandsRoot)) {
     return [skippedMissingSource3("commands", sourceCommandsRoot)];
   }
-  const sourceCommands = ts(path32.join(sourceCommandsRoot, "*.md")).sort();
+  const sourceCommands = ts(path33.join(sourceCommandsRoot, "*.md")).sort();
   const skillsRoot = resolveTargetPath(paths.skills);
   return sourceCommands.map((commandFile) => {
-    const baseName = path32.basename(commandFile, ".md");
-    const destination = path32.join(skillsRoot, baseName, "SKILL.md");
-    const commandContent = fs32.readFileSync(commandFile, "utf8");
-    const relativeSource = `commands/${path32.basename(commandFile)}`;
+    const baseName = path33.basename(commandFile, ".md");
+    const destination = path33.join(skillsRoot, baseName, "SKILL.md");
+    const commandContent = fs33.readFileSync(commandFile, "utf8");
+    const relativeSource = `commands/${path33.basename(commandFile)}`;
     const marker = formatProvenanceMarker(
       "markdown",
       relativeSource,
@@ -26508,8 +26641,8 @@ ${commandContent.trim()}
   });
 }
 function syncSkills3(config, sourceRoot, options, logger, manifest, scopePath, component = "skills", destination = "", asSymlink = false) {
-  const source = path32.resolve(sourceRoot, config.source.skills);
-  if (!fs32.existsSync(source)) {
+  const source = path33.resolve(sourceRoot, config.source.skills);
+  if (!fs33.existsSync(source)) {
     return skippedMissingSource3(component, source);
   }
   if (options.dryRun) {
@@ -26523,18 +26656,18 @@ function syncSkills3(config, sourceRoot, options, logger, manifest, scopePath, c
       return { component, status: "skipped-current", path: destination };
     }
     if (artifactClass === "managed-stale" && isOurStaleSymlink(destination, /* @__PURE__ */ new Set([destination]), config)) {
-      fs32.unlinkSync(destination);
+      fs33.unlinkSync(destination);
     } else if (artifactClass === "unmanaged-conflict" && !handleConflict3(destination, config, options, logger, manifest, scopePath)) {
       return { component, status: "conflict", path: destination };
     } else if (artifactClass === "managed-symlink") {
-      fs32.unlinkSync(destination);
+      fs33.unlinkSync(destination);
     }
-    ensureDir(path32.dirname(destination));
+    ensureDir(path33.dirname(destination));
     createRelativeSymlink(source, destination, "dir");
     logger.verbose(`Skills: created shared skills symlink ${destination}`);
     return { component, status: "success", path: destination };
   }
-  if (fs32.existsSync(destination)) {
+  if (fs33.existsSync(destination)) {
     return { component, status: "skipped-current", path: destination };
   }
   ensureDir(destination);
@@ -26545,7 +26678,7 @@ function syncHooks3(config, sourceRoot, paths, mappings, options, lossReport, lo
   const source = resolveHooksSourceFile(sourceRoot, config);
   const sourceLabel = hooksSourceLabel(config);
   const destination = resolveTargetPath(paths.hooks_file);
-  const sourceHooksJson = fs32.existsSync(source) ? JSON.parse(fs32.readFileSync(source, "utf8")) : { hooks: {} };
+  const sourceHooksJson = fs33.existsSync(source) ? JSON.parse(fs33.readFileSync(source, "utf8")) : { hooks: {} };
   const compiled = compileHooks(
     sourceHooksJson,
     "cursor",
@@ -26559,18 +26692,18 @@ function syncHooks3(config, sourceRoot, paths, mappings, options, lossReport, lo
   }
   const hooksFileContent = `${JSON.stringify({ version: 1, hooks: compiled.payload }, null, 2)}
 `;
-  ensureDir(path32.dirname(destination));
-  fs32.writeFileSync(destination, hooksFileContent);
+  ensureDir(path33.dirname(destination));
+  fs33.writeFileSync(destination, hooksFileContent);
   return { component: "hooks", status: "success", path: destination };
 }
 function syncMcp3(config, sourceRoot, paths, options, lossReport, logger, manifest, scopePath) {
   const source = resolveMcpSourceFile(sourceRoot, config);
   const sourceLabel = mcpSourceLabel(config);
   const destination = resolveTargetPath(paths.mcp_file);
-  if (!fs32.existsSync(source)) {
+  if (!fs33.existsSync(source)) {
     return skippedMissingSource3("mcp", source);
   }
-  const sourceMcpJson = JSON.parse(fs32.readFileSync(source, "utf8"));
+  const sourceMcpJson = JSON.parse(fs33.readFileSync(source, "utf8"));
   const mcpJson = compileMcp(sourceMcpJson, "cursor", lossReport, sourceLabel);
   if (options.dryRun) {
     logger.info(`[dry-run] mcp: compile ${source} -> ${destination}`);
@@ -26621,13 +26754,13 @@ function syncPermissions(config, paths, options, _lossReport, logger, manifest,
   );
 }
 function syncProviderPin(config, sourceRoot, lossReport) {
-  const agentsDir = path32.join(sourceRoot, config.source.agents);
-  if (!fs32.existsSync(agentsDir)) return;
-  for (const agentFile of ts(path32.join(agentsDir, "*.md")).sort()) {
+  const agentsDir = path33.join(sourceRoot, config.source.agents);
+  if (!fs33.existsSync(agentsDir)) return;
+  for (const agentFile of ts(path33.join(agentsDir, "*.md")).sort()) {
     const { data } = parseMarkdownFrontmatter(agentFile);
     const hasCustomProvider = typeof data.provider === "string" || typeof data.provider === "object" && data.provider !== null && Object.keys(data.provider).length > 0;
     if (hasCustomProvider) {
-      const relativeSource = `agents/${path32.basename(agentFile)}`;
+      const relativeSource = `agents/${path33.basename(agentFile)}`;
       addLoss(lossReport, "cursor", "agents", {
         source: relativeSource,
         fields: [
@@ -26639,7 +26772,7 @@ function syncProviderPin(config, sourceRoot, lossReport) {
               "provider",
               "provider-not-representable"
             ),
-            detail: `${path32.basename(agentFile)}: custom provider cannot be expressed in Cursor subagent frontmatter \u2014 configure manually via Cursor settings`
+            detail: `${path33.basename(agentFile)}: custom provider cannot be expressed in Cursor subagent frontmatter \u2014 configure manually via Cursor settings`
           }
         ]
       });
@@ -26654,8 +26787,8 @@ function writeCompiledArtifact3(component, destination, content, expectedHash, c
   if (artifactClass === "unmanaged-conflict" && !handleConflict3(destination, config, options, logger, manifest, scopePath)) {
     return { component, status: "conflict", path: destination };
   }
-  ensureDir(path32.dirname(destination));
-  fs32.writeFileSync(destination, content);
+  ensureDir(path33.dirname(destination));
+  fs33.writeFileSync(destination, content);
   return { component, status: "success", path: destination };
 }
 function handleConflict3(destination, config, options, logger, manifest, scopePath) {
@@ -26674,16 +26807,16 @@ function handleConflict3(destination, config, options, logger, manifest, scopePa
       backupFile(destination, manifest);
       writeManifest(scopePath, manifest);
     } else {
-      fs32.renameSync(destination, `${destination}.bak.${Date.now()}`);
+      fs33.renameSync(destination, `${destination}.bak.${Date.now()}`);
     }
     return true;
   }
-  fs32.rmSync(destination, { recursive: true, force: true });
+  fs33.rmSync(destination, { recursive: true, force: true });
   return true;
 }
 function isCompiledCurrent3(destination, expectedContent, expectedHash) {
   try {
-    const current = fs32.readFileSync(destination, "utf8");
+    const current = fs33.readFileSync(destination, "utf8");
     const marker = extractProvenanceMarker(current);
     return expectedHash ? marker?.hash === expectedHash && marker.target === "cursor" && current === expectedContent : current === expectedContent;
   } catch {
@@ -26702,7 +26835,7 @@ function shouldSkipComponent3(options, component) {
 }
 function isSymlinkTo3(linkPath, source) {
   try {
-    return fs32.realpathSync(linkPath) === fs32.realpathSync(source);
+    return fs33.realpathSync(linkPath) === fs33.realpathSync(source);
   } catch {
     return false;
   }
@@ -26713,8 +26846,8 @@ function hashString3(value) {
 
 // src/adapters/cline.ts
 import crypto8 from "crypto";
-import fs33 from "fs";
-import path33 from "path";
+import fs34 from "fs";
+import path34 from "path";
 function syncCline(config, sourceRoot, mappings, extensions, options, lossReport, logger, manifest, scopePath) {
   const scope = options.scope ?? "global";
   const profile = resolveTargetPaths({
@@ -26827,7 +26960,7 @@ function syncCline(config, sourceRoot, mappings, extensions, options, lossReport
 function syncInstructions3(config, sourceRoot, paths, scope, options, lossReport, logger, manifest, scopePath) {
   if (scope === "global" || paths.instructions === null) {
     addLoss(lossReport, "cline", "instructions", {
-      source: path33.basename(config.source.instructions),
+      source: path34.basename(config.source.instructions),
       fields: [
         {
           field: "instructions",
@@ -26847,12 +26980,12 @@ function syncInstructions3(config, sourceRoot, paths, scope, options, lossReport
       path: "cline/global/instructions: no committable global path"
     };
   }
-  const source = path33.join(sourceRoot, config.source.instructions);
+  const source = path34.join(sourceRoot, config.source.instructions);
   const destination = resolveTargetPath(paths.instructions);
-  const baseContent = fs33.existsSync(source) ? fs33.readFileSync(source, "utf8").trim() : "";
+  const baseContent = fs34.existsSync(source) ? fs34.readFileSync(source, "utf8").trim() : "";
   const marker = formatProvenanceMarker(
     "markdown",
-    path33.basename(config.source.instructions),
+    path34.basename(config.source.instructions),
     hashString4(baseContent),
     "cline"
   );
@@ -26877,11 +27010,11 @@ ${baseContent}
   );
 }
 function syncAgents4(config, sourceRoot, mappings, extensions, options, lossReport, logger) {
-  const sourceAgentsRoot = path33.join(sourceRoot, config.source.agents);
-  if (!fs33.existsSync(sourceAgentsRoot)) {
+  const sourceAgentsRoot = path34.join(sourceRoot, config.source.agents);
+  if (!fs34.existsSync(sourceAgentsRoot)) {
     return [skippedMissingSource4("agents", sourceAgentsRoot)];
   }
-  const sourceAgents = ts(path33.join(sourceAgentsRoot, "*.md")).sort();
+  const sourceAgents = ts(path34.join(sourceAgentsRoot, "*.md")).sort();
   return sourceAgents.map((agentFile) => {
     compileAgent(agentFile, "cline", mappings, extensions, lossReport);
     if (options.dryRun) {
@@ -26897,14 +27030,14 @@ function syncAgents4(config, sourceRoot, mappings, extensions, options, lossRepo
   });
 }
 function syncRules3(config, sourceRoot, paths, mappings, options, lossReport, logger, manifest, scopePath) {
-  const sourceRulesDir = path33.join(sourceRoot, config.source.rules);
-  if (!fs33.existsSync(sourceRulesDir)) {
+  const sourceRulesDir = path34.join(sourceRoot, config.source.rules);
+  if (!fs34.existsSync(sourceRulesDir)) {
     return [skippedMissingSource4("rules", sourceRulesDir)];
   }
   const compiled = compileRules(sourceRulesDir, "cline", mappings, lossReport);
   const rulesDir = resolveTargetPath(paths.rules);
   return compiled.dotRulesFiles.map(({ name, content }) => {
-    const destination = path33.join(rulesDir, name);
+    const destination = path34.join(rulesDir, name);
     if (options.dryRun) {
       logger.info(`[dry-run] rules: write ${destination}`);
       return {
@@ -26928,17 +27061,17 @@ function syncRules3(config, sourceRoot, paths, mappings, options, lossReport, lo
   });
 }
 function syncCommands3(config, sourceRoot, paths, options, logger, manifest, scopePath) {
-  const sourceCommandsRoot = path33.join(sourceRoot, config.source.commands);
-  if (!fs33.existsSync(sourceCommandsRoot)) {
+  const sourceCommandsRoot = path34.join(sourceRoot, config.source.commands);
+  if (!fs34.existsSync(sourceCommandsRoot)) {
     return [skippedMissingSource4("commands", sourceCommandsRoot)];
   }
-  const sourceCommands = ts(path33.join(sourceCommandsRoot, "*.md")).sort();
+  const sourceCommands = ts(path34.join(sourceCommandsRoot, "*.md")).sort();
   const workflowsRoot = resolveTargetPath(paths.workflows);
   return sourceCommands.map((commandFile) => {
-    const baseName = path33.basename(commandFile);
-    const destination = path33.join(workflowsRoot, baseName);
-    const commandContent = fs33.readFileSync(commandFile, "utf8");
-    const relativeSource = `commands/${path33.basename(commandFile)}`;
+    const baseName = path34.basename(commandFile);
+    const destination = path34.join(workflowsRoot, baseName);
+    const commandContent = fs34.readFileSync(commandFile, "utf8");
+    const relativeSource = `commands/${path34.basename(commandFile)}`;
     const marker = formatProvenanceMarker(
       "markdown",
       relativeSource,
@@ -26973,9 +27106,9 @@ ${commandContent.trim()}
   });
 }
 function syncSkills4(config, sourceRoot, paths, options, logger, manifest, scopePath) {
-  const source = path33.resolve(sourceRoot, config.source.skills);
+  const source = path34.resolve(sourceRoot, config.source.skills);
   const destination = resolveTargetPath(paths.skills);
-  if (!fs33.existsSync(source)) {
+  if (!fs34.existsSync(source)) {
     return skippedMissingSource4("skills", source);
   }
   if (options.dryRun) {
@@ -26995,9 +27128,9 @@ function syncSkills4(config, sourceRoot, paths, options, logger, manifest, scope
       return { component: "skills", status: "conflict", path: destination };
     }
   } else if (artifactClass === "managed-symlink") {
-    fs33.unlinkSync(destination);
+    fs34.unlinkSync(destination);
   }
-  ensureDir(path33.dirname(destination));
+  ensureDir(path34.dirname(destination));
   createRelativeSymlink(source, destination, "dir");
   logger.verbose(`Skills: created Cline skills symlink ${destination}`);
   return { component: "skills", status: "success", path: destination };
@@ -27005,7 +27138,7 @@ function syncSkills4(config, sourceRoot, paths, options, logger, manifest, scope
 function syncHooks4(config, sourceRoot, mappings, options, lossReport, logger) {
   const source = resolveHooksSourceFile(sourceRoot, config);
   const sourceLabel = hooksSourceLabel(config);
-  const sourceHooksJson = fs33.existsSync(source) ? JSON.parse(fs33.readFileSync(source, "utf8")) : { hooks: {} };
+  const sourceHooksJson = fs34.existsSync(source) ? JSON.parse(fs34.readFileSync(source, "utf8")) : { hooks: {} };
   compileHooks(sourceHooksJson, "cline", mappings, lossReport, sourceLabel);
   if (options.dryRun) {
     logger.info(`[dry-run] hooks: record hook-as-plugin loss for ${source}`);
@@ -27020,10 +27153,10 @@ function syncMcp4(config, sourceRoot, paths, options, lossReport, logger, manife
   const source = resolveMcpSourceFile(sourceRoot, config);
   const sourceLabel = mcpSourceLabel(config);
   const destination = resolveTargetPath(paths.mcp_file);
-  if (!fs33.existsSync(source)) {
+  if (!fs34.existsSync(source)) {
     return skippedMissingSource4("mcp", source);
   }
-  const sourceMcpJson = JSON.parse(fs33.readFileSync(source, "utf8"));
+  const sourceMcpJson = JSON.parse(fs34.readFileSync(source, "utf8"));
   const mcpJson = compileMcp(sourceMcpJson, "cline", lossReport, sourceLabel);
   if (options.dryRun) {
     logger.info(`[dry-run] mcp: compile ${source} -> ${destination}`);
@@ -27066,11 +27199,11 @@ function syncSettings(lossReport) {
   };
 }
 function syncProviderAndModel(config, sourceRoot, lossReport) {
-  const agentsDir = path33.join(sourceRoot, config.source.agents);
-  if (!fs33.existsSync(agentsDir)) return;
-  for (const agentFile of ts(path33.join(agentsDir, "*.md")).sort()) {
+  const agentsDir = path34.join(sourceRoot, config.source.agents);
+  if (!fs34.existsSync(agentsDir)) return;
+  for (const agentFile of ts(path34.join(agentsDir, "*.md")).sort()) {
     const { data } = parseMarkdownFrontmatter(agentFile);
-    const relativeSource = `agents/${path33.basename(agentFile)}`;
+    const relativeSource = `agents/${path34.basename(agentFile)}`;
     const hasCustomProvider = typeof data.provider === "string" || typeof data.provider === "object" && data.provider !== null && Object.keys(data.provider).length > 0;
     if (hasCustomProvider) {
       addLoss(lossReport, "cline", "agents", {
@@ -27084,7 +27217,7 @@ function syncProviderAndModel(config, sourceRoot, lossReport) {
               "provider",
               "provider-not-representable"
             ),
-            detail: `${path33.basename(agentFile)}: Cline provider is interface-only (Settings \u2192 API Provider); configure manually.`
+            detail: `${path34.basename(agentFile)}: Cline provider is interface-only (Settings \u2192 API Provider); configure manually.`
           }
         ]
       });
@@ -27102,7 +27235,7 @@ function syncProviderAndModel(config, sourceRoot, lossReport) {
               "model",
               "model-not-representable"
             ),
-            detail: `${path33.basename(agentFile)}: Cline model pin is interface-only (Settings \u2192 Model); configure manually.`
+            detail: `${path34.basename(agentFile)}: Cline model pin is interface-only (Settings \u2192 Model); configure manually.`
           }
         ]
       });
@@ -27117,8 +27250,8 @@ function writeCompiledArtifact4(component, destination, content, expectedHash, c
   if (artifactClass === "unmanaged-conflict" && !handleConflict4(destination, config, options, logger, manifest, scopePath)) {
     return { component, status: "conflict", path: destination };
   }
-  ensureDir(path33.dirname(destination));
-  fs33.writeFileSync(destination, content);
+  ensureDir(path34.dirname(destination));
+  fs34.writeFileSync(destination, content);
   return { component, status: "success", path: destination };
 }
 function handleConflict4(destination, config, options, logger, manifest, scopePath) {
@@ -27137,16 +27270,16 @@ function handleConflict4(destination, config, options, logger, manifest, scopePa
       backupFile(destination, manifest);
       writeManifest(scopePath, manifest);
     } else {
-      fs33.renameSync(destination, `${destination}.bak.${Date.now()}`);
+      fs34.renameSync(destination, `${destination}.bak.${Date.now()}`);
     }
     return true;
   }
-  fs33.rmSync(destination, { recursive: true, force: true });
+  fs34.rmSync(destination, { recursive: true, force: true });
   return true;
 }
 function isCompiledCurrent4(destination, expectedContent, expectedHash) {
   try {
-    const current = fs33.readFileSync(destination, "utf8");
+    const current = fs34.readFileSync(destination, "utf8");
     const marker = extractProvenanceMarker(current);
     return expectedHash ? marker?.hash === expectedHash && marker.target === "cline" && current === expectedContent : current === expectedContent;
   } catch {
@@ -27165,7 +27298,7 @@ function shouldSkipComponent4(options, component) {
 }
 function isSymlinkTo4(linkPath, source) {
   try {
-    return fs33.realpathSync(linkPath) === fs33.realpathSync(source);
+    return fs34.realpathSync(linkPath) === fs34.realpathSync(source);
   } catch {
     return false;
   }
@@ -27176,9 +27309,9 @@ function hashString4(value) {
 
 // src/adapters/opencode.ts
 import crypto9 from "crypto";
-import fs34 from "fs";
+import fs35 from "fs";
 import os6 from "os";
-import path34 from "path";
+import path35 from "path";
 var import_yaml10 = __toESM(require_dist(), 1);
 function syncOpenCode(config, sourceRoot, mappings, extensions, options, lossReport, logger, manifest, scopePath) {
   const scope = options.scope ?? "global";
@@ -27196,7 +27329,7 @@ function syncOpenCode(config, sourceRoot, mappings, extensions, options, lossRep
     config_doc: profile.config_doc
   };
   const rules = compileRules(
-    path34.join(sourceRoot, config.source.rules),
+    path35.join(sourceRoot, config.source.rules),
     "opencode",
     mappings,
     lossReport
@@ -27298,16 +27431,16 @@ function syncOpenCode(config, sourceRoot, mappings, extensions, options, lossRep
   return { target: "opencode", outcomes };
 }
 function syncInstructions4(config, sourceRoot, paths, agentsAppendix, options, logger, manifest, scopePath) {
-  const source = path34.join(sourceRoot, config.source.instructions);
+  const source = path35.join(sourceRoot, config.source.instructions);
   const destination = resolveTargetPath(paths.instructions);
-  const baseContent = fs34.existsSync(source) ? fs34.readFileSync(source, "utf8").trim() : "";
+  const baseContent = fs35.existsSync(source) ? fs35.readFileSync(source, "utf8").trim() : "";
   const composed = agentsAppendix ? `${baseContent}
 
 --- tangyr managed rules ---
 ${agentsAppendix}`.trim() : baseContent;
   const marker = formatProvenanceMarker(
     "markdown",
-    path34.basename(config.source.instructions),
+    path35.basename(config.source.instructions),
     hashString5(composed),
     "opencode"
   );
@@ -27334,16 +27467,16 @@ ${composed}
   );
 }
 function syncAgents5(config, sourceRoot, paths, mappings, extensions, options, lossReport, logger, manifest, scopePath) {
-  const sourceAgentsRoot = path34.join(sourceRoot, config.source.agents);
-  if (!fs34.existsSync(sourceAgentsRoot)) {
+  const sourceAgentsRoot = path35.join(sourceRoot, config.source.agents);
+  if (!fs35.existsSync(sourceAgentsRoot)) {
     return [skippedMissingSource5("agents", sourceAgentsRoot)];
   }
-  const sourceAgents = ts(path34.join(sourceAgentsRoot, "*.md")).sort();
+  const sourceAgents = ts(path35.join(sourceAgentsRoot, "*.md")).sort();
   const agentsRoot = resolveTargetPath(paths.agents);
   return sourceAgents.map((agentFile) => {
-    const destination = path34.join(
+    const destination = path35.join(
       agentsRoot,
-      `${path34.basename(agentFile, ".md")}.md`
+      `${path35.basename(agentFile, ".md")}.md`
     );
     let compiled;
     try {
@@ -27407,11 +27540,11 @@ function applyProviderModelBinding(compiled, mappings) {
   return `${before}${(0, import_yaml10.stringify)(fields).trim()}${after}`;
 }
 function syncCommands4(config, sourceRoot, paths, options, logger, manifest, scopePath) {
-  const sourceCommandsRoot = path34.join(sourceRoot, config.source.commands);
-  if (!fs34.existsSync(sourceCommandsRoot)) {
+  const sourceCommandsRoot = path35.join(sourceRoot, config.source.commands);
+  if (!fs35.existsSync(sourceCommandsRoot)) {
     return [skippedMissingSource5("commands", sourceCommandsRoot)];
   }
-  const sourceCommands = ts(path34.join(sourceCommandsRoot, "*.md")).sort();
+  const sourceCommands = ts(path35.join(sourceCommandsRoot, "*.md")).sort();
   const commandsRoot = resolveTargetPath(paths.commands);
   return sourceCommands.map((commandFile) => {
     const { data, body } = parseCommandFile(commandFile);
@@ -27425,7 +27558,7 @@ function syncCommands4(config, sourceRoot, paths, options, logger, manifest, sco
     if (typeof data.model === "string") {
       frontmatter.model = data.model;
     }
-    const relativeSource = `commands/${path34.basename(commandFile)}`;
+    const relativeSource = `commands/${path35.basename(commandFile)}`;
     const marker = formatProvenanceMarker(
       "markdown",
       relativeSource,
@@ -27441,9 +27574,9 @@ ${body.trimEnd()}
 ` : `${marker}
 ${body.trimEnd()}
 `;
-    const destination = path34.join(
+    const destination = path35.join(
       commandsRoot,
-      `${path34.basename(commandFile, ".md")}.md`
+      `${path35.basename(commandFile, ".md")}.md`
     );
     if (options.dryRun) {
       logger.info(
@@ -27470,8 +27603,8 @@ ${body.trimEnd()}
   });
 }
 function syncSkills5(config, sourceRoot, _paths, options, logger, manifest, scopePath, component = "skills", destination = "") {
-  const source = path34.resolve(sourceRoot, config.source.skills);
-  if (!fs34.existsSync(source)) {
+  const source = path35.resolve(sourceRoot, config.source.skills);
+  if (!fs35.existsSync(source)) {
     return skippedMissingSource5(component, source);
   }
   if (options.dryRun) {
@@ -27483,13 +27616,13 @@ function syncSkills5(config, sourceRoot, _paths, options, logger, manifest, scop
     return { component, status: "skipped-current", path: destination };
   }
   if (artifactClass === "managed-stale" && isOurStaleSymlink(destination, /* @__PURE__ */ new Set([destination]), config)) {
-    fs34.unlinkSync(destination);
+    fs35.unlinkSync(destination);
   } else if (artifactClass === "unmanaged-conflict" && !handleConflict5(destination, config, options, logger, manifest, scopePath)) {
     return { component, status: "conflict", path: destination };
   } else if (artifactClass === "managed-symlink") {
-    fs34.unlinkSync(destination);
+    fs35.unlinkSync(destination);
   }
-  ensureDir(path34.dirname(destination));
+  ensureDir(path35.dirname(destination));
   createRelativeSymlink(source, destination, "dir");
   logger.verbose(`Skills: created skills path ${destination}`);
   return { component, status: "success", path: destination };
@@ -27498,13 +27631,13 @@ function syncMcp5(config, sourceRoot, paths, mappings, options, lossReport, logg
   const source = resolveMcpSourceFile(sourceRoot, config);
   const sourceLabel = mcpSourceLabel(config);
   const destination = resolveTargetPath(paths.config_doc);
-  if (!fs34.existsSync(source)) {
+  if (!fs35.existsSync(source)) {
     if (!options.dryRun) {
       syncConfigDoc(paths, {}, lossReport, {}, mappings);
     }
     return skippedMissingSource5("mcp", source);
   }
-  const sourceMcpJson = JSON.parse(fs34.readFileSync(source, "utf8"));
+  const sourceMcpJson = JSON.parse(fs35.readFileSync(source, "utf8"));
   const mcpJson = compileMcp(
     sourceMcpJson,
     "opencode",
@@ -27535,7 +27668,7 @@ function syncPermissions2(config, _sourceRoot, paths, options, lossReport, logge
 function syncHooks5(config, sourceRoot, mappings, options, lossReport) {
   const source = resolveHooksSourceFile(sourceRoot, config);
   const sourceLabel = hooksSourceLabel(config);
-  const sourceHooksJson = fs34.existsSync(source) ? JSON.parse(fs34.readFileSync(source, "utf8")) : { hooks: {} };
+  const sourceHooksJson = fs35.existsSync(source) ? JSON.parse(fs35.readFileSync(source, "utf8")) : { hooks: {} };
   compileHooks(sourceHooksJson, "opencode", mappings, lossReport, sourceLabel);
   const message = "hooks: Skip \u2014 OpenCode exposes hooks only as plugin code (hook-as-plugin loss recorded)";
   return { component: "hooks", status: "skipped", path: message };
@@ -27569,9 +27702,9 @@ function syncProviderBlock(mappings) {
 function syncConfigDoc(paths, mcpEntries, _lossReport, permissionMap, mappings) {
   const destination = resolveTargetPath(paths.config_doc);
   let existing = {};
-  if (fs34.existsSync(destination)) {
+  if (fs35.existsSync(destination)) {
     try {
-      existing = JSON.parse(fs34.readFileSync(destination, "utf8"));
+      existing = JSON.parse(fs35.readFileSync(destination, "utf8"));
     } catch {
       existing = {};
     }
@@ -27596,8 +27729,8 @@ function syncConfigDoc(paths, mcpEntries, _lossReport, permissionMap, mappings)
       };
     }
   }
-  ensureDir(path34.dirname(destination));
-  fs34.writeFileSync(destination, `${JSON.stringify(config, null, 2)}
+  ensureDir(path35.dirname(destination));
+  fs35.writeFileSync(destination, `${JSON.stringify(config, null, 2)}
 `);
 }
 function writeCompiledArtifact5(component, destination, content, expectedHash, config, sourceRoot, options, logger, manifest, scopePath) {
@@ -27608,8 +27741,8 @@ function writeCompiledArtifact5(component, destination, content, expectedHash, c
   if (artifactClass === "unmanaged-conflict" && !handleConflict5(destination, config, options, logger, manifest, scopePath)) {
     return { component, status: "conflict", path: destination };
   }
-  ensureDir(path34.dirname(destination));
-  fs34.writeFileSync(destination, content);
+  ensureDir(path35.dirname(destination));
+  fs35.writeFileSync(destination, content);
   return { component, status: "success", path: destination };
 }
 function handleConflict5(destination, config, options, logger, manifest, scopePath) {
@@ -27628,16 +27761,16 @@ function handleConflict5(destination, config, options, logger, manifest, scopePa
       backupFile(destination, manifest);
       writeManifest(scopePath, manifest);
     } else {
-      fs34.renameSync(destination, `${destination}.bak.${Date.now()}`);
+      fs35.renameSync(destination, `${destination}.bak.${Date.now()}`);
     }
     return true;
   }
-  fs34.rmSync(destination, { recursive: true, force: true });
+  fs35.rmSync(destination, { recursive: true, force: true });
   return true;
 }
 function isCompiledCurrent5(destination, expectedContent, expectedHash) {
   try {
-    const current = fs34.readFileSync(destination, "utf8");
+    const current = fs35.readFileSync(destination, "utf8");
     const marker = extractProvenanceMarker(current);
     return expectedHash ? marker?.hash === expectedHash && marker.target === "opencode" && current === expectedContent : current === expectedContent;
   } catch {
@@ -27656,7 +27789,7 @@ function shouldSkipComponent5(options, component) {
 }
 function isSymlinkTo5(linkPath, source) {
   try {
-    return fs34.realpathSync(linkPath) === fs34.realpathSync(source);
+    return fs35.realpathSync(linkPath) === fs35.realpathSync(source);
   } catch {
     return false;
   }
@@ -27665,7 +27798,7 @@ function hashString5(value) {
   return `sha256:${crypto9.createHash("sha256").update(value).digest("hex")}`;
 }
 function parseCommandFile(commandFile) {
-  const content = fs34.readFileSync(commandFile, "utf8");
+  const content = fs35.readFileSync(commandFile, "utf8");
   if (!content.startsWith("---\n")) {
     return { data: {}, body: content };
   }
@@ -27685,10 +27818,10 @@ function parseCommandFile(commandFile) {
 // src/commands/install.ts
 function isBackupableFile(targetPath) {
   try {
-    const lstat = fs35.lstatSync(targetPath);
+    const lstat = fs36.lstatSync(targetPath);
     if (lstat.isDirectory()) return false;
     if (lstat.isSymbolicLink()) {
-      const stat = fs35.statSync(targetPath);
+      const stat = fs36.statSync(targetPath);
       return stat.isFile();
     }
     return lstat.isFile();
@@ -27698,10 +27831,10 @@ function isBackupableFile(targetPath) {
 }
 function backupConflictingTarget(targetPath, scopePath) {
   const ts2 = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/gu, "").replace("T", "T").replace(/\.\d+Z$/u, "Z");
-  const relativeToRoot = path35.relative("/", targetPath).replace(/^\.\.\/+/gu, "");
-  const backupPath = path35.join(scopePath, "backups", ts2, relativeToRoot);
-  fs35.mkdirSync(path35.dirname(backupPath), { recursive: true });
-  fs35.copyFileSync(targetPath, backupPath);
+  const relativeToRoot = path36.relative("/", targetPath).replace(/^\.\.\/+/gu, "");
+  const backupPath = path36.join(scopePath, "backups", ts2, relativeToRoot);
+  fs36.mkdirSync(path36.dirname(backupPath), { recursive: true });
+  fs36.copyFileSync(targetPath, backupPath);
   return backupPath;
 }
 async function runInstallCommand(options, logger) {
@@ -27730,7 +27863,7 @@ async function runInstallCommand(options, logger) {
     );
   }
   const kitName = resolvedKitName ?? config.kit;
-  const kitPath = kitPathOverride ?? (options.kitPath ? path35.resolve(options.kitPath) : config.kitPath);
+  const kitPath = kitPathOverride ?? (options.kitPath ? path36.resolve(options.kitPath) : config.kitPath);
   if (!kitName && !kitPath) {
     logger.error(
       "No kit specified. Use --kit <name>, --kit-path <path>, or set 'kit'/'kitPath' in tangyr.config.yaml."
@@ -27871,7 +28004,7 @@ ACCEPTED CONFLICTS (backup-and-replace applied to ${conflictingFindings.length}
           logger.info(`    source: ${finding.tool}`);
           logger.info(`    action: backup-and-replace`);
           logger.info(`    backup: ${backupLocation}`);
-        } else if (fs35.existsSync(finding.path)) {
+        } else if (fs36.existsSync(finding.path)) {
           logger.info(`  - ${finding.path}`);
           logger.info(`    source: ${finding.tool}`);
           logger.info(
@@ -27982,7 +28115,7 @@ SKIPPED CONFLICTS (${skippedTargetPaths.size} target(s) left unchanged):`
   writeManifest(scopePath, manifest);
   logger.info(`
 Installation complete: ${installedCount} files installed.`);
-  logger.info(`Manifest written to ${path35.join(scopePath, "manifest.json")}`);
+  logger.info(`Manifest written to ${path36.join(scopePath, "manifest.json")}`);
   logger.info(`Kit: ${kitInfo.name} (archetype: ${kitInfo.archetype})`);
   logger.info(`Scope: ${scope}`);
   logger.info(`Tools: ${tools.join(", ")}`);
@@ -28124,13 +28257,13 @@ function applyClaudeCodePlacements(placements, manifest, skippedTargetPaths, log
       logger.verbose(`  skipped (operator choice): ${placement.destination}`);
       continue;
     }
-    const destDir = path35.dirname(placement.destination);
-    fs35.mkdirSync(destDir, { recursive: true });
+    const destDir = path36.dirname(placement.destination);
+    fs36.mkdirSync(destDir, { recursive: true });
     if (placement.type === "symlink") {
-      if (fs35.existsSync(placement.destination) || isSymlink2(placement.destination)) {
+      if (fs36.existsSync(placement.destination) || isSymlink2(placement.destination)) {
         removeManagedPath(placement.destination);
       }
-      fs35.symlinkSync(
+      fs36.symlinkSync(
         placement.source,
         placement.destination,
         placement.isDir ? "dir" : "file"
@@ -28139,12 +28272,12 @@ function applyClaudeCodePlacements(placements, manifest, skippedTargetPaths, log
         `  symlink: ${placement.source} \u2192 ${placement.destination}`
       );
     } else {
-      fs35.copyFileSync(placement.source, placement.destination);
+      fs36.copyFileSync(placement.source, placement.destination);
       logger.verbose(`  copy: ${placement.source} \u2192 ${placement.destination}`);
     }
     addArtifactToManifest(manifest, {
       relativePath: placement.manifestKey,
-      hash: fs35.statSync(placement.source).isDirectory() ? `dir:${placement.source}` : computeSourceHash(placement.source),
+      hash: fs36.statSync(placement.source).isDirectory() ? `dir:${placement.source}` : computeSourceHash(placement.source),
       origin: "tangyr-managed"
     });
     count++;
@@ -28391,11 +28524,11 @@ function syncOutcomeToManifestKey(tool, outcome, mappings, scope = "global", pro
     if (outcome.path === mcpFile2) {
       return "cline/mcp.json";
     }
-    if (outcome.path.startsWith(`${workflowsRoot}${path35.sep}`)) {
-      return `cline/workflows/${path35.basename(outcome.path)}`;
+    if (outcome.path.startsWith(`${workflowsRoot}${path36.sep}`)) {
+      return `cline/workflows/${path36.basename(outcome.path)}`;
     }
-    if (outcome.path.startsWith(`${rulesRoot2}${path35.sep}`)) {
-      return `cline/rules/${path35.basename(outcome.path)}`;
+    if (outcome.path.startsWith(`${rulesRoot2}${path36.sep}`)) {
+      return `cline/rules/${path36.basename(outcome.path)}`;
     }
     return null;
   }
@@ -28431,14 +28564,14 @@ function syncOutcomeToManifestKey(tool, outcome, mappings, scope = "global", pro
     if (outcome.path === permissionsFile) {
       return "cursor/permissions.json";
     }
-    if (outcome.path.startsWith(`${agentsRoot2}${path35.sep}`)) {
-      return `cursor/agents/${path35.basename(outcome.path)}`;
+    if (outcome.path.startsWith(`${agentsRoot2}${path36.sep}`)) {
+      return `cursor/agents/${path36.basename(outcome.path)}`;
     }
-    if (outcome.path.startsWith(`${rulesRoot2}${path35.sep}`)) {
-      return `cursor/rules/${path35.basename(outcome.path)}`;
+    if (outcome.path.startsWith(`${rulesRoot2}${path36.sep}`)) {
+      return `cursor/rules/${path36.basename(outcome.path)}`;
     }
-    if (outcome.path.startsWith(`${skillsRoot2}${path35.sep}`)) {
-      const rel = path35.relative(skillsRoot2, outcome.path);
+    if (outcome.path.startsWith(`${skillsRoot2}${path36.sep}`)) {
+      const rel = path36.relative(skillsRoot2, outcome.path);
       return `cursor/skills/${rel}`;
     }
     return null;
@@ -28464,14 +28597,14 @@ function syncOutcomeToManifestKey(tool, outcome, mappings, scope = "global", pro
     if (outcome.path === skillsSharedRoot) {
       return "opencode/skills_shared";
     }
-    if (outcome.path.startsWith(`${agentsRoot2}${path35.sep}`)) {
-      return `opencode/agents/${path35.basename(outcome.path)}`;
+    if (outcome.path.startsWith(`${agentsRoot2}${path36.sep}`)) {
+      return `opencode/agents/${path36.basename(outcome.path)}`;
     }
-    if (outcome.path.startsWith(`${commandsRoot}${path35.sep}`)) {
-      return `opencode/commands/${path35.basename(outcome.path)}`;
+    if (outcome.path.startsWith(`${commandsRoot}${path36.sep}`)) {
+      return `opencode/commands/${path36.basename(outcome.path)}`;
     }
     if (outcome.path === configDocFile) {
-      return `opencode/${path35.basename(outcome.path)}`;
+      return `opencode/${path36.basename(outcome.path)}`;
     }
     return null;
   }
@@ -28485,17 +28618,17 @@ function syncOutcomeToManifestKey(tool, outcome, mappings, scope = "global", pro
     if (outcome.path === skillsRoot2) {
       return "copilot/skills";
     }
-    if (outcome.path.startsWith(`${agentsRoot2}${path35.sep}`)) {
-      return `copilot/agents/${path35.basename(outcome.path)}`;
+    if (outcome.path.startsWith(`${agentsRoot2}${path36.sep}`)) {
+      return `copilot/agents/${path36.basename(outcome.path)}`;
     }
-    if (outcome.path.startsWith(`${promptsRoot}${path35.sep}`)) {
-      return `copilot/prompts/${path35.basename(outcome.path)}`;
+    if (outcome.path.startsWith(`${promptsRoot}${path36.sep}`)) {
+      return `copilot/prompts/${path36.basename(outcome.path)}`;
     }
-    if (outcome.path.startsWith(`${hooksRoot}${path35.sep}`)) {
-      return `copilot/hooks/${path35.basename(outcome.path)}`;
+    if (outcome.path.startsWith(`${hooksRoot}${path36.sep}`)) {
+      return `copilot/hooks/${path36.basename(outcome.path)}`;
     }
     if (outcome.path === mcpFile2) {
-      return `copilot/${path35.basename(outcome.path)}`;
+      return `copilot/${path36.basename(outcome.path)}`;
     }
     return null;
   }
@@ -28511,17 +28644,17 @@ function syncOutcomeToManifestKey(tool, outcome, mappings, scope = "global", pro
   if (outcome.path === skillsRoot) {
     return "codex/skills";
   }
-  if (outcome.path.startsWith(`${agentsRoot}${path35.sep}`)) {
-    return `codex/agents/${path35.basename(outcome.path)}`;
+  if (outcome.path.startsWith(`${agentsRoot}${path36.sep}`)) {
+    return `codex/agents/${path36.basename(outcome.path)}`;
   }
-  if (outcome.path.startsWith(`${rulesRoot}${path35.sep}`)) {
-    return `codex/rules/${path35.basename(outcome.path)}`;
+  if (outcome.path.startsWith(`${rulesRoot}${path36.sep}`)) {
+    return `codex/rules/${path36.basename(outcome.path)}`;
   }
   if (outcome.path === hooksFile) {
-    return `codex/${path35.basename(outcome.path)}`;
+    return `codex/${path36.basename(outcome.path)}`;
   }
   if (outcome.path === mcpFile) {
-    return `codex/${path35.basename(outcome.path)}`;
+    return `codex/${path36.basename(outcome.path)}`;
   }
   return null;
 }
@@ -28556,8 +28689,8 @@ function getClaudeCodePlacements(kitInfo, scope = "global", projectRoot, mapping
     };
   }
   const placements = [];
-  const claudeMd = path35.join(kitInfo.path, "CLAUDE.md");
-  if (fs35.existsSync(claudeMd)) {
+  const claudeMd = path36.join(kitInfo.path, "CLAUDE.md");
+  if (fs36.existsSync(claudeMd)) {
     placements.push({
       source: claudeMd,
       destination: resolvedPaths.instructions,
@@ -28573,8 +28706,8 @@ function getClaudeCodePlacements(kitInfo, scope = "global", projectRoot, mapping
     rules: resolvedPaths.rules
   };
   for (const [component, targetPath] of Object.entries(componentDirMap)) {
-    const componentDir = path35.join(kitInfo.path, component);
-    if (fs35.existsSync(componentDir) && fs35.statSync(componentDir).isDirectory()) {
+    const componentDir = path36.join(kitInfo.path, component);
+    if (fs36.existsSync(componentDir) && fs36.statSync(componentDir).isDirectory()) {
       placements.push({
         source: componentDir,
         destination: targetPath,
@@ -28588,8 +28721,8 @@ function getClaudeCodePlacements(kitInfo, scope = "global", projectRoot, mapping
 }
 function getClaudeCodePlacementsFromProfile(kitInfo, profile) {
   const placements = [];
-  const claudeMd = path35.join(kitInfo.path, "CLAUDE.md");
-  if (fs35.existsSync(claudeMd)) {
+  const claudeMd = path36.join(kitInfo.path, "CLAUDE.md");
+  if (fs36.existsSync(claudeMd)) {
     placements.push({
       source: claudeMd,
       destination: profile.instructions,
@@ -28605,8 +28738,8 @@ function getClaudeCodePlacementsFromProfile(kitInfo, profile) {
     rules: profile.rules
   };
   for (const [component, targetPath] of Object.entries(componentDirMap)) {
-    const componentDir = path35.join(kitInfo.path, component);
-    if (fs35.existsSync(componentDir) && fs35.statSync(componentDir).isDirectory()) {
+    const componentDir = path36.join(kitInfo.path, component);
+    if (fs36.existsSync(componentDir) && fs36.statSync(componentDir).isDirectory()) {
       placements.push({
         source: componentDir,
         destination: targetPath,
@@ -28620,8 +28753,8 @@ function getClaudeCodePlacementsFromProfile(kitInfo, profile) {
 }
 function collectAllFiles(kitInfo) {
   const files = /* @__PURE__ */ new Map();
-  const claudeMd = path35.join(kitInfo.path, "CLAUDE.md");
-  if (fs35.existsSync(claudeMd)) {
+  const claudeMd = path36.join(kitInfo.path, "CLAUDE.md");
+  if (fs36.existsSync(claudeMd)) {
     files.set("CLAUDE.md", claudeMd);
   }
   for (const [component, reconciliation] of Object.entries(
@@ -28631,15 +28764,15 @@ function collectAllFiles(kitInfo) {
     const missingSet = new Set(reconciliation.missing);
     for (const entry of reconciliation.declared) {
       if (missingSet.has(entry)) continue;
-      const relPath = isSkills ? path35.join(component, entry) : path35.join(component, `${entry}.md`);
-      files.set(relPath, path35.join(kitInfo.path, relPath));
+      const relPath = isSkills ? path36.join(component, entry) : path36.join(component, `${entry}.md`);
+      files.set(relPath, path36.join(kitInfo.path, relPath));
     }
   }
   return files;
 }
 function isSymlink2(p) {
   try {
-    return fs35.lstatSync(p).isSymbolicLink();
+    return fs36.lstatSync(p).isSymbolicLink();
   } catch {
     return false;
   }
@@ -28684,14 +28817,14 @@ async function runKitUpdateCommand(options, logger) {
 }
 
 // src/commands/list.ts
-import path36 from "path";
+import path37 from "path";
 function runListCommand(options, logger) {
   let searchPaths = [];
-  let directKitPath = options.kitPath ? path36.resolve(options.kitPath) : void 0;
+  let directKitPath = options.kitPath ? path37.resolve(options.kitPath) : void 0;
   try {
     const { config, configDir } = resolveConfig(options.config);
     searchPaths = config.kitSearchPaths ?? [
-      path36.join(configDir, "operating-kits")
+      path37.join(configDir, "operating-kits")
     ];
     directKitPath = directKitPath ?? config.kitPath;
   } catch (err) {
@@ -28766,7 +28899,7 @@ function withDirectKit(kits, directKitPath) {
     return kits;
   }
   const directKit = loadKit(directKitPath);
-  if (kits.some((kit) => path36.resolve(kit.path) === directKit.path)) {
+  if (kits.some((kit) => path37.resolve(kit.path) === directKit.path)) {
     return kits;
   }
   return [...kits, directKit];
@@ -28774,12 +28907,12 @@ function withDirectKit(kits, directKitPath) {
 
 // src/commands/probe.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import fs36 from "fs";
-import path37 from "path";
+import fs37 from "fs";
+import path38 from "path";
 function runProbeCommand(options, logger) {
   const { config, configDir, sourceRoot } = resolveRuntime(options, import.meta.url);
   const platformPaths = readYamlObject(
-    path37.join(
+    path38.join(
       resolveConfiguredPath(config.mappings, configDir, sourceRoot, "mappings"),
       "platform-paths.yaml"
     )
@@ -28813,12 +28946,12 @@ function toProbeRow(target, key, rawPath) {
   const resolved = resolveTargetPath(rawPath);
   let accessible = false;
   try {
-    fs36.accessSync(resolved);
+    fs37.accessSync(resolved);
     accessible = true;
   } catch {
     accessible = false;
   }
-  return { target, key, path: resolved, exists: fs36.existsSync(resolved), accessible };
+  return { target, key, path: resolved, exists: fs37.existsSync(resolved), accessible };
 }
 function codexRuntimeProbeRows() {
   const rows = commandProbeRows("codex", "binary", process.platform === "win32" ? "where.exe" : "which", ["codex"]);
@@ -28829,7 +28962,7 @@ function codexRuntimeProbeRows() {
     ["binary_snap", "/snap/bin/codex"],
     ["binary_flatpak", "/var/lib/flatpak/exports/bin/codex"]
   ]) {
-    if (fs36.existsSync(candidatePath)) {
+    if (fs37.existsSync(candidatePath)) {
       rows.push(toProbeRow("codex", key, candidatePath));
     }
   }
@@ -28845,8 +28978,8 @@ function commandProbeRows(target, key, command, args) {
 
 // src/commands/status.ts
 import crypto10 from "crypto";
-import fs37 from "fs";
-import path38 from "path";
+import fs38 from "fs";
+import path39 from "path";
 function runStatusCommand(options, logger) {
   const { config, configDir, sourceRoot } = resolveRuntime(
     options,
@@ -28925,21 +29058,21 @@ function classifyCodexFiles(config, sourceRoot, configDir) {
     rules: paths.rules
   };
   const rules = compileRules(
-    path38.join(sourceRoot, config.source.rules),
+    path39.join(sourceRoot, config.source.rules),
     "codex",
     mappings,
     createLossReport()
   );
-  const instructionsSource = fs37.readFileSync(path38.join(sourceRoot, config.source.instructions), "utf8").trim();
+  const instructionsSource = fs38.readFileSync(path39.join(sourceRoot, config.source.instructions), "utf8").trim();
   const composedInstructions = `${instructionsSource}
 
 --- tangyr managed rules ---
 ${rules.agentsAppendix}`.trim();
   const agentFiles = ts(
-    path38.join(sourceRoot, config.source.agents, "*.md")
+    path39.join(sourceRoot, config.source.agents, "*.md")
   ).sort();
-  const hooksSource = path38.join(sourceRoot, config.source.hooks, "hooks.json");
-  const mcpSource = path38.join(sourceRoot, config.source.mcp);
+  const hooksSource = path39.join(sourceRoot, config.source.hooks, "hooks.json");
+  const mcpSource = path39.join(sourceRoot, config.source.mcp);
   const ruleRows = rules.dotRulesFiles.length === 0 ? [
     {
       component: "rules",
@@ -28950,7 +29083,7 @@ ${rules.agentsAppendix}`.trim();
   ] : rules.dotRulesFiles.map(
     (ruleFile) => classifyCompiledFile(
       `rules/${ruleFile.name}`,
-      path38.join(resolveTargetPath(codexPaths.rules), ruleFile.name),
+      path39.join(resolveTargetPath(codexPaths.rules), ruleFile.name),
       "codex",
       void 0,
       config,
@@ -28968,10 +29101,10 @@ ${rules.agentsAppendix}`.trim();
     ),
     ...agentFiles.map(
       (agentFile) => classifyCompiledFile(
-        `agents/${path38.basename(agentFile, ".md")}`,
-        path38.join(
+        `agents/${path39.basename(agentFile, ".md")}`,
+        path39.join(
           resolveTargetPath(codexPaths.agents),
-          `${path38.basename(agentFile, ".md")}.toml`
+          `${path39.basename(agentFile, ".md")}.toml`
         ),
         "codex",
         computeSourceHash(agentFile),
@@ -28995,11 +29128,11 @@ ${rules.agentsAppendix}`.trim();
       config,
       sourceRoot
     ),
-    fs37.existsSync(hooksSource) ? classifyCodexHooksFile(resolveTargetPath(codexPaths.hooksSharedFile)) : notConfiguredRow(
+    fs38.existsSync(hooksSource) ? classifyCodexHooksFile(resolveTargetPath(codexPaths.hooksSharedFile)) : notConfiguredRow(
       "hooks",
       resolveTargetPath(codexPaths.hooksSharedFile)
     ),
-    fs37.existsSync(mcpSource) ? classifyCompiledFile(
+    fs38.existsSync(mcpSource) ? classifyCompiledFile(
       "mcp",
       resolveTargetPath(codexPaths.mcpSharedFile),
       "codex",
@@ -29019,7 +29152,7 @@ function classifyCodexHooksFile(filePath) {
       conformant: true
     };
   }
-  if (!fs37.existsSync(filePath)) {
+  if (!fs38.existsSync(filePath)) {
     return {
       component: "hooks",
       className: "missing",
@@ -29051,20 +29184,20 @@ function classifyCopilotFiles(config, sourceRoot, configDir) {
     mcpSharedFile: paths.mcp_shared_file
   };
   const agentFiles = ts(
-    path38.join(sourceRoot, config.source.agents, "*.md")
+    path39.join(sourceRoot, config.source.agents, "*.md")
   ).sort();
   const commandFiles = ts(
-    path38.join(sourceRoot, config.source.commands, "*.md")
+    path39.join(sourceRoot, config.source.commands, "*.md")
   ).sort();
-  const hooksSource = path38.join(sourceRoot, config.source.hooks, "hooks.json");
-  const mcpSource = path38.join(sourceRoot, config.source.mcp);
+  const hooksSource = path39.join(sourceRoot, config.source.hooks, "hooks.json");
+  const mcpSource = path39.join(sourceRoot, config.source.mcp);
   return [
     ...agentFiles.map(
       (agentFile) => classifyCompiledFile(
-        `agents/${path38.basename(agentFile, ".md")}`,
-        path38.join(
+        `agents/${path39.basename(agentFile, ".md")}`,
+        path39.join(
           resolveTargetPath(copilotPaths.agents),
-          `${path38.basename(agentFile, ".md")}.agent.md`
+          `${path39.basename(agentFile, ".md")}.agent.md`
         ),
         "copilot",
         computeSourceHash(agentFile),
@@ -29081,10 +29214,10 @@ function classifyCopilotFiles(config, sourceRoot, configDir) {
     ),
     ...commandFiles.map(
       (commandFile) => classifyCompiledFile(
-        `commands/${path38.basename(commandFile, ".md")}`,
-        path38.join(
+        `commands/${path39.basename(commandFile, ".md")}`,
+        path39.join(
           resolveTargetPath(copilotPaths.prompts),
-          `${path38.basename(commandFile, ".md")}.prompt.md`
+          `${path39.basename(commandFile, ".md")}.prompt.md`
         ),
         "copilot",
         computeSourceHash(commandFile),
@@ -29102,9 +29235,9 @@ function classifyCopilotFiles(config, sourceRoot, configDir) {
       config,
       sourceRoot
     ),
-    fs37.existsSync(hooksSource) ? classifyCompiledFile(
+    fs38.existsSync(hooksSource) ? classifyCompiledFile(
       "hooks",
-      path38.join(
+      path39.join(
         resolveTargetPath(copilotPaths.hooks),
         "tangyr-managed.json"
       ),
@@ -29114,12 +29247,12 @@ function classifyCopilotFiles(config, sourceRoot, configDir) {
       sourceRoot
     ) : notConfiguredRow(
       "hooks",
-      path38.join(
+      path39.join(
         resolveTargetPath(copilotPaths.hooks),
         "tangyr-managed.json"
       )
     ),
-    fs37.existsSync(mcpSource) ? classifyCompiledFile(
+    fs38.existsSync(mcpSource) ? classifyCompiledFile(
       "mcp",
       resolveTargetPath(copilotPaths.mcpSharedFile),
       "copilot",
@@ -29139,7 +29272,7 @@ function notConfiguredRow(component, filePath) {
 }
 function classifyDirectArtifact(artifact, config, sourceRoot) {
   const artifactClass = classifyArtifact(artifact.path, config, sourceRoot);
-  const sourcePath = artifact.sourceKey ? path38.resolve(sourceRoot, config.source[artifact.sourceKey]) : void 0;
+  const sourcePath = artifact.sourceKey ? path39.resolve(sourceRoot, config.source[artifact.sourceKey]) : void 0;
   if (artifactClass === "managed-symlink" && sourcePath && !isSymlinkCurrent(artifact.path, sourcePath)) {
     return {
       component: artifact.component,
@@ -29228,9 +29361,9 @@ function classifyClaudeSharedFiles(config, sourceRoot) {
     classifyHooks(settingsPath),
     classifySettings(
       settingsPath,
-      path38.resolve(sourceRoot, config.source.settings)
+      path39.resolve(sourceRoot, config.source.settings)
     ),
-    classifyMcp(claudeJsonPath, path38.resolve(sourceRoot, config.source.mcp))
+    classifyMcp(claudeJsonPath, path39.resolve(sourceRoot, config.source.mcp))
   ];
 }
 function classifyHooks(filePath) {
@@ -29294,14 +29427,14 @@ function classifyMcp(filePath, sourcePath) {
 }
 function isSymlinkCurrent(linkPath, sourcePath) {
   try {
-    return fs37.realpathSync(linkPath) === fs37.realpathSync(sourcePath);
+    return fs38.realpathSync(linkPath) === fs38.realpathSync(sourcePath);
   } catch {
     return false;
   }
 }
 function isCompiledCurrent6(filePath, sourcePath) {
   try {
-    const marker = extractProvenanceMarker(fs37.readFileSync(filePath, "utf8"));
+    const marker = extractProvenanceMarker(fs38.readFileSync(filePath, "utf8"));
     return marker?.hash === computeSourceHash(sourcePath) && marker.target === "claude-code";
   } catch {
     return false;
@@ -29331,7 +29464,7 @@ function classifyCompiledFile(component, filePath, target, expectedHash, config,
 }
 function readCompiledContent(filePath) {
   try {
-    return fs37.readFileSync(filePath, "utf8");
+    return fs38.readFileSync(filePath, "utf8");
   } catch {
     return null;
   }
@@ -29362,8 +29495,8 @@ function hashString6(value) {
 }
 
 // src/commands/sync.ts
-import fs40 from "fs";
-import path41 from "path";
+import fs41 from "fs";
+import path42 from "path";
 
 // node_modules/chalk/source/vendor/ansi-styles/index.js
 var ANSI_BACKGROUND_OFFSET = 10;
@@ -29861,8 +29994,8 @@ var chalkStderr = createChalk({ level: stderrColor ? stderrColor.level : 0 });
 var source_default = chalk;
 
 // src/adapters/claude-code.ts
-import fs39 from "fs";
-import path40 from "path";
+import fs40 from "fs";
+import path41 from "path";
 
 // src/core/shim.ts
 import crypto11 from "crypto";
@@ -29879,12 +30012,12 @@ ${SHIM_BODY}`;
 
 // src/compiler/hook-components.ts
 var import_yaml11 = __toESM(require_dist(), 1);
-import fs38 from "fs";
-import path39 from "path";
+import fs39 from "fs";
+import path40 from "path";
 function parseHookDeclaration(filePath) {
   let raw;
   try {
-    raw = fs38.readFileSync(filePath, "utf8");
+    raw = fs39.readFileSync(filePath, "utf8");
   } catch {
     return null;
   }
@@ -29967,9 +30100,9 @@ function synthesizeHooksJson(declarations) {
   return { hooks };
 }
 function loadSourceHooks(hooksDir, hookNames) {
-  const hooksJsonPath = path39.join(hooksDir, "hooks.json");
-  if (fs38.existsSync(hooksJsonPath)) {
-    const raw = fs38.readFileSync(hooksJsonPath, "utf8");
+  const hooksJsonPath = path40.join(hooksDir, "hooks.json");
+  if (fs39.existsSync(hooksJsonPath)) {
+    const raw = fs39.readFileSync(hooksJsonPath, "utf8");
     return JSON.parse(raw);
   }
   const declarations = loadHookDeclarations(hooksDir, hookNames);
@@ -29980,14 +30113,14 @@ function loadHookDeclarations(hooksDir, hookNames) {
   if (hookNames && hookNames.length > 0) {
     names = hookNames;
   } else {
-    if (!fs38.existsSync(hooksDir) || !fs38.statSync(hooksDir).isDirectory()) {
+    if (!fs39.existsSync(hooksDir) || !fs39.statSync(hooksDir).isDirectory()) {
       return [];
     }
-    names = fs38.readdirSync(hooksDir).filter((f) => f.endsWith(".md") && !f.startsWith(".")).map((f) => f.slice(0, -3)).sort();
+    names = fs39.readdirSync(hooksDir).filter((f) => f.endsWith(".md") && !f.startsWith(".")).map((f) => f.slice(0, -3)).sort();
   }
   const declarations = [];
   for (const name of names) {
-    const filePath = path39.join(hooksDir, `${name}.md`);
+    const filePath = path40.join(hooksDir, `${name}.md`);
     const decl = parseHookDeclaration(filePath);
     if (decl) {
       declarations.push(decl);
@@ -30111,7 +30244,7 @@ function syncClaudeCode(config, sourceRoot, options, logger, mappings, manifest,
   }
   if (!shouldSkipComponent6(options, "instructions") && manifest && scopePath) {
     const shimPath = profile.instructions_shim;
-    const agentsMdPath = path40.resolve(sourceRoot, config.source.instructions);
+    const agentsMdPath = path41.resolve(sourceRoot, config.source.instructions);
     if (!options.dryRun) {
       applyClaudeCodeShimUpgrade(
         shimPath,
@@ -30165,13 +30298,13 @@ function syncClaudeCode(config, sourceRoot, options, logger, mappings, manifest,
 }
 function syncProviderLoss2(config, sourceRoot, mappings, lossReport) {
   if (!mappings.modelTiers.custom_provider) return;
-  const agentsDir = path40.join(sourceRoot, config.source.agents);
-  if (!fs39.existsSync(agentsDir)) return;
-  for (const agentFile of ts(path40.join(agentsDir, "*.md")).sort()) {
+  const agentsDir = path41.join(sourceRoot, config.source.agents);
+  if (!fs40.existsSync(agentsDir)) return;
+  for (const agentFile of ts(path41.join(agentsDir, "*.md")).sort()) {
     const { data } = parseMarkdownFrontmatter(agentFile);
     const hasProvider = typeof data.provider === "string" || typeof data.provider === "object" && data.provider !== null && Object.keys(data.provider).length > 0;
     if (hasProvider) {
-      const basename = path40.basename(agentFile);
+      const basename = path41.basename(agentFile);
       addLoss(lossReport, "claude-code", "agents", {
         source: `agents/${basename}`,
         fields: [
@@ -30196,19 +30329,19 @@ function shouldSkipComponent6(options, component) {
 function applyClaudeCodeShimUpgrade(shimPath, agentsMdPath, manifest, scopePath, logger) {
   const expectedBodyHash = shimBodyHash();
   const shimContent = buildAgentsMdShim(shimPath, agentsMdPath, "claude-code");
-  if (!fs39.existsSync(shimPath)) {
+  if (!fs40.existsSync(shimPath)) {
     manifest.artifacts.push({
-      relativePath: path40.relative(scopePath, shimPath),
+      relativePath: path41.relative(scopePath, shimPath),
       hash: expectedBodyHash,
       origin: "tangyr-managed"
     });
     writeManifest(scopePath, manifest);
-    fs39.mkdirSync(path40.dirname(shimPath), { recursive: true });
-    fs39.writeFileSync(shimPath, shimContent);
+    fs40.mkdirSync(path41.dirname(shimPath), { recursive: true });
+    fs40.writeFileSync(shimPath, shimContent);
     logger?.verbose(`instructions-shim: wrote @AGENTS.md shim -> ${shimPath}`);
     return;
   }
-  const existing = fs39.readFileSync(shimPath, "utf8");
+  const existing = fs40.readFileSync(shimPath, "utf8");
   const firstNonEmptyLine = existing.split("\n").find((l) => l.trim().length > 0) ?? "";
   const marker = extractProvenanceMarker(firstNonEmptyLine);
   if (marker !== null && marker.hash === expectedBodyHash) {
@@ -30219,21 +30352,21 @@ function applyClaudeCodeShimUpgrade(shimPath, agentsMdPath, manifest, scopePath,
   }
   backupFile(shimPath, manifest);
   writeManifest(scopePath, manifest);
-  fs39.writeFileSync(shimPath, shimContent);
+  fs40.writeFileSync(shimPath, shimContent);
   manifest.artifacts.push({
-    relativePath: path40.relative(scopePath, shimPath),
+    relativePath: path41.relative(scopePath, shimPath),
     hash: expectedBodyHash,
     origin: "tangyr-managed"
   });
   logger?.verbose(`instructions-shim: backed up and replaced -> ${shimPath}`);
 }
 function syncDirectComponent(config, sourceRoot, options, logger, directComponent, manifest, scopePath) {
-  const source = path40.resolve(
+  const source = path41.resolve(
     sourceRoot,
     config.source[directComponent.sourceKey]
   );
   const destination = directComponent.destination;
-  if (!fs39.existsSync(source)) {
+  if (!fs40.existsSync(source)) {
     return skippedMissingSource6(directComponent.component, source);
   }
   if (options.dryRun) {
@@ -30255,7 +30388,7 @@ function syncDirectComponent(config, sourceRoot, options, logger, directComponen
     };
   }
   if (artifactClass === "managed-stale" && isOurStaleSymlink(destination, /* @__PURE__ */ new Set([destination]), config)) {
-    fs39.unlinkSync(destination);
+    fs40.unlinkSync(destination);
   } else if (artifactClass === "unmanaged-conflict" && !handleConflict6(destination, config, options, logger, manifest, scopePath)) {
     return {
       component: directComponent.component,
@@ -30263,9 +30396,9 @@ function syncDirectComponent(config, sourceRoot, options, logger, directComponen
       path: destination
     };
   } else if (artifactClass === "managed-symlink") {
-    fs39.unlinkSync(destination);
+    fs40.unlinkSync(destination);
   }
-  ensureDir(path40.dirname(destination));
+  ensureDir(path41.dirname(destination));
   createRelativeSymlink(source, destination, directComponent.type, {
     logger,
     provenanceMarker: directComponent.type === "file" ? formatProvenanceMarker(
@@ -30282,8 +30415,8 @@ function syncDirectComponent(config, sourceRoot, options, logger, directComponen
   };
 }
 function syncClaudeCodeSkills(config, sourceRoot, options, logger, destination, manifest, scopePath) {
-  const source = path40.resolve(sourceRoot, config.source.skills);
-  if (!fs39.existsSync(source)) {
+  const source = path41.resolve(sourceRoot, config.source.skills);
+  if (!fs40.existsSync(source)) {
     return [skippedMissingSource6("skills", source)];
   }
   const declaredNames = resolveKitSkillNames(sourceRoot);
@@ -30293,7 +30426,7 @@ function syncClaudeCodeSkills(config, sourceRoot, options, logger, destination,
     if (isLegacyWholesaleSymlink) {
       for (const name of foreignSkillNames(source, declaredNames)) {
         logger.info(
-          `[dry-run] skills: migrate foreign skill ${path40.join(source, name)} -> ${path40.join(destination, name)}`
+          `[dry-run] skills: migrate foreign skill ${path41.join(source, name)} -> ${path41.join(destination, name)}`
         );
       }
       logger.info(
@@ -30301,9 +30434,9 @@ function syncClaudeCodeSkills(config, sourceRoot, options, logger, destination,
       );
     }
     for (const name of declaredNames ?? listSkillDirNames(source)) {
-      const skillDestination = path40.join(destination, name);
+      const skillDestination = path41.join(destination, name);
       logger.info(
-        `[dry-run] skills: symlink ${path40.join(source, name)} -> ${skillDestination}`
+        `[dry-run] skills: symlink ${path41.join(source, name)} -> ${skillDestination}`
       );
       outcomes2.push({
         component: "skills",
@@ -30336,9 +30469,9 @@ function syncClaudeCodeSkills(config, sourceRoot, options, logger, destination,
   return outcomes;
 }
 function syncSingleSkill(config, sourceRoot, options, logger, source, destination, name, manifest, scopePath) {
-  const skillSource = path40.join(source, name);
-  const skillDestination = path40.join(destination, name);
-  if (!fs39.existsSync(skillSource)) {
+  const skillSource = path41.join(source, name);
+  const skillDestination = path41.join(destination, name);
+  if (!fs40.existsSync(skillSource)) {
     return skippedMissingSource6("skills", skillSource);
   }
   const artifactClass = classifyArtifact(skillDestination, config, sourceRoot);
@@ -30350,7 +30483,7 @@ function syncSingleSkill(config, sourceRoot, options, logger, source, destinatio
     };
   }
   if (artifactClass === "managed-stale" && isOurStaleSymlink(skillDestination, /* @__PURE__ */ new Set([skillDestination]), config)) {
-    fs39.unlinkSync(skillDestination);
+    fs40.unlinkSync(skillDestination);
   } else if (artifactClass === "unmanaged-conflict" && !handleConflict6(
     skillDestination,
     config,
@@ -30361,25 +30494,25 @@ function syncSingleSkill(config, sourceRoot, options, logger, source, destinatio
   )) {
     return { component: "skills", status: "conflict", path: skillDestination };
   } else if (artifactClass === "managed-symlink") {
-    fs39.unlinkSync(skillDestination);
+    fs40.unlinkSync(skillDestination);
   }
   createRelativeSymlink(skillSource, skillDestination, "dir");
   return { component: "skills", status: "success", path: skillDestination };
 }
 function migrateWholesaleSkillsSymlink(source, destination, declaredNames, logger) {
   const foreignNames = foreignSkillNames(source, declaredNames);
-  fs39.unlinkSync(destination);
+  fs40.unlinkSync(destination);
   ensureDir(destination);
   for (const name of foreignNames) {
-    const from = path40.join(source, name);
-    const to = path40.join(destination, name);
-    if (fs39.existsSync(to)) {
+    const from = path41.join(source, name);
+    const to = path41.join(destination, name);
+    if (fs40.existsSync(to)) {
       logger.warn(
         `skills migration: ${to} already exists \u2014 skipping move of ${from} to avoid overwrite`
       );
       continue;
     }
-    fs39.renameSync(from, to);
+    fs40.renameSync(from, to);
     logger.info(`skills migration: moved ${from} -> ${to}`);
   }
 }
@@ -30391,21 +30524,21 @@ function foreignSkillNames(source, declaredNames) {
   return listSkillDirNames(source).filter((name) => !declaredSet.has(name));
 }
 function listSkillDirNames(dir) {
-  if (!fs39.existsSync(dir)) {
+  if (!fs40.existsSync(dir)) {
     return [];
   }
-  return fs39.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => entry.name);
+  return fs40.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => entry.name);
 }
 function isSymlinkPath(filePath) {
   try {
-    return fs39.lstatSync(filePath).isSymbolicLink();
+    return fs40.lstatSync(filePath).isSymbolicLink();
   } catch {
     return false;
   }
 }
 function syncHookScriptsBridge(config, sourceRoot, options, logger, destination, manifest, scopePath) {
-  const source = path40.resolve(sourceRoot, config.source.hooks);
-  if (!fs39.existsSync(source)) {
+  const source = path41.resolve(sourceRoot, config.source.hooks);
+  if (!fs40.existsSync(source)) {
     return skippedMissingSource6("hooks", source);
   }
   if (options.dryRun) {
@@ -30417,13 +30550,13 @@ function syncHookScriptsBridge(config, sourceRoot, options, logger, destination,
     return { component: "hooks", status: "skipped-current", path: destination };
   }
   if (artifactClass === "managed-stale" && isOurStaleSymlink(destination, /* @__PURE__ */ new Set([destination]), config)) {
-    fs39.unlinkSync(destination);
+    fs40.unlinkSync(destination);
   } else if (artifactClass === "unmanaged-conflict" && !handleConflict6(destination, config, options, logger, manifest, scopePath)) {
     return { component: "hooks", status: "conflict", path: destination };
   } else if (artifactClass === "managed-symlink") {
-    fs39.unlinkSync(destination);
+    fs40.unlinkSync(destination);
   }
-  ensureDir(path40.dirname(destination));
+  ensureDir(path41.dirname(destination));
   createRelativeSymlink(source, destination, "dir");
   return { component: "hooks", status: "success", path: destination };
 }
@@ -30446,7 +30579,7 @@ function syncHooks6(config, sourceRoot, options, logger, destination) {
     destination,
     settings,
     stringifyJson3,
-    !fs39.existsSync(destination),
+    !fs40.existsSync(destination),
     logger
   );
   return {
@@ -30456,8 +30589,8 @@ function syncHooks6(config, sourceRoot, options, logger, destination) {
   };
 }
 function syncMcp6(config, sourceRoot, options, logger, destination) {
-  const source = path40.resolve(sourceRoot, config.source.mcp);
-  if (!fs39.existsSync(source)) {
+  const source = path41.resolve(sourceRoot, config.source.mcp);
+  if (!fs40.existsSync(source)) {
     return skippedMissingSource6("mcp", source);
   }
   if (options.dryRun) {
@@ -30482,7 +30615,7 @@ function syncMcp6(config, sourceRoot, options, logger, destination) {
     destination,
     hostConfig,
     stringifyJson3,
-    !fs39.existsSync(destination),
+    !fs40.existsSync(destination),
     logger
   );
   return {
@@ -30492,8 +30625,8 @@ function syncMcp6(config, sourceRoot, options, logger, destination) {
   };
 }
 function syncSettings2(config, sourceRoot, options, logger, destination) {
-  const source = path40.resolve(sourceRoot, config.source.settings);
-  if (!fs39.existsSync(source)) {
+  const source = path41.resolve(sourceRoot, config.source.settings);
+  if (!fs40.existsSync(source)) {
     return skippedMissingSource6("settings", source);
   }
   if (options.dryRun) {
@@ -30511,7 +30644,7 @@ function syncSettings2(config, sourceRoot, options, logger, destination) {
     destination,
     settings,
     stringifyJson3,
-    !fs39.existsSync(destination),
+    !fs40.existsSync(destination),
     logger
   );
   return {
@@ -30536,11 +30669,11 @@ function handleConflict6(destination, config, options, logger, manifest, scopePa
       backupFile(destination, manifest);
       writeManifest(scopePath, manifest);
     } else {
-      fs39.renameSync(destination, `${destination}.bak.${Date.now()}`);
+      fs40.renameSync(destination, `${destination}.bak.${Date.now()}`);
     }
     return true;
   }
-  fs39.rmSync(destination, { recursive: true, force: true });
+  fs40.rmSync(destination, { recursive: true, force: true });
   return true;
 }
 function skippedMissingSource6(component, source) {
@@ -30552,16 +30685,16 @@ function skippedMissingSource6(component, source) {
 }
 function isSymlinkTo6(linkPath, source) {
   try {
-    return fs39.realpathSync(linkPath) === fs39.realpathSync(source);
+    return fs40.realpathSync(linkPath) === fs40.realpathSync(source);
   } catch {
     return false;
   }
 }
 function readJsonObject4(filePath) {
-  if (!fs39.existsSync(filePath)) {
+  if (!fs40.existsSync(filePath)) {
     return {};
   }
-  const parsed = JSON.parse(fs39.readFileSync(filePath, "utf8"));
+  const parsed = JSON.parse(fs40.readFileSync(filePath, "utf8"));
   return isRecord5(parsed) ? parsed : {};
 }
 function markManaged(value) {
@@ -30827,7 +30960,7 @@ function writeLossReport(filePath, report) {
   if (!filePath) {
     return;
   }
-  fs40.writeFileSync(filePath, `${JSON.stringify(report, null, 2)}
+  fs41.writeFileSync(filePath, `${JSON.stringify(report, null, 2)}
 `);
 }
 function prepareKitManifest(scope, projectRoot, kitInfo) {
@@ -30868,8 +31001,8 @@ function updateManifest(kitInfo, kitSync) {
   writeManifest(kitSync.scopePath, kitSync.manifest);
 }
 function resolveKitFilePath(kitPath, relativePath) {
-  const fullPath = path41.join(kitPath, relativePath);
-  return fs40.existsSync(fullPath) ? fullPath : null;
+  const fullPath = path42.join(kitPath, relativePath);
+  return fs41.existsSync(fullPath) ? fullPath : null;
 }
 function cleanupRemovedManagedArtifacts(config, mappings, targets, options, removedSourcePaths, logger) {
   if (removedSourcePaths.length === 0 || !mappings) {
@@ -30930,9 +31063,9 @@ function cleanupRemovedCopilotArtifact(relativePath, paths, logger) {
   }
   if (relativePath.startsWith("agents/")) {
     removeManagedCompiledArtifact2(
-      path41.join(
+      path42.join(
         resolveTargetPath(paths.agents ?? ""),
-        `${path41.parse(relativePath).name}.agent.md`
+        `${path42.parse(relativePath).name}.agent.md`
       ),
       "copilot",
       relativePath,
@@ -30942,9 +31075,9 @@ function cleanupRemovedCopilotArtifact(relativePath, paths, logger) {
   }
   if (relativePath.startsWith("commands/")) {
     removeManagedCompiledArtifact2(
-      path41.join(
+      path42.join(
         resolveTargetPath(paths.prompts ?? ""),
-        `${path41.parse(relativePath).name}.prompt.md`
+        `${path42.parse(relativePath).name}.prompt.md`
       ),
       "copilot",
       relativePath,
@@ -30954,7 +31087,7 @@ function cleanupRemovedCopilotArtifact(relativePath, paths, logger) {
   }
   if (relativePath.endsWith("hooks.json")) {
     removeManagedCompiledArtifact2(
-      path41.join(resolveTargetPath(paths.hooks ?? ""), "tangyr-managed.json"),
+      path42.join(resolveTargetPath(paths.hooks ?? ""), "tangyr-managed.json"),
       "copilot",
       relativePath,
       logger
@@ -30984,9 +31117,9 @@ function cleanupRemovedCodexArtifact(relativePath, paths, logger) {
   }
   if (relativePath.startsWith("agents/")) {
     removeManagedCompiledArtifact2(
-      path41.join(
+      path42.join(
         resolveTargetPath(paths.agents ?? ""),
-        `${path41.parse(relativePath).name}.toml`
+        `${path42.parse(relativePath).name}.toml`
       ),
       "codex",
       relativePath,
@@ -30996,9 +31129,9 @@ function cleanupRemovedCodexArtifact(relativePath, paths, logger) {
   }
   if (relativePath.startsWith("rules/")) {
     removeManagedCompiledArtifact2(
-      path41.join(
+      path42.join(
         resolveTargetPath(paths.rules ?? ""),
-        `${path41.parse(relativePath).name}.rules`
+        `${path42.parse(relativePath).name}.rules`
       ),
       "codex",
       relativePath,
@@ -31037,9 +31170,9 @@ function cleanupRemovedOpenCodeArtifact(relativePath, paths, logger) {
   }
   if (relativePath.startsWith("agents/")) {
     removeManagedCompiledArtifact2(
-      path41.join(
+      path42.join(
         resolveTargetPath(paths.agents ?? ""),
-        `${path41.parse(relativePath).name}.md`
+        `${path42.parse(relativePath).name}.md`
       ),
       "opencode",
       relativePath,
@@ -31049,9 +31182,9 @@ function cleanupRemovedOpenCodeArtifact(relativePath, paths, logger) {
   }
   if (relativePath.startsWith("commands/")) {
     removeManagedCompiledArtifact2(
-      path41.join(
+      path42.join(
         resolveTargetPath(paths.commands ?? ""),
-        `${path41.parse(relativePath).name}.md`
+        `${path42.parse(relativePath).name}.md`
       ),
       "opencode",
       relativePath,
@@ -31083,9 +31216,9 @@ function cleanupRemovedCursorArtifact(relativePath, paths, logger) {
   }
   if (relativePath.startsWith("agents/")) {
     removeManagedCompiledArtifact2(
-      path41.join(
+      path42.join(
         resolveTargetPath(paths.agents ?? ""),
-        `${path41.parse(relativePath).name}.md`
+        `${path42.parse(relativePath).name}.md`
       ),
       "cursor",
       relativePath,
@@ -31095,9 +31228,9 @@ function cleanupRemovedCursorArtifact(relativePath, paths, logger) {
   }
   if (relativePath.startsWith("rules/")) {
     removeManagedCompiledArtifact2(
-      path41.join(
+      path42.join(
         resolveTargetPath(paths.rules ?? ""),
-        `${path41.parse(relativePath).name}.mdc`
+        `${path42.parse(relativePath).name}.mdc`
       ),
       "cursor",
       relativePath,
@@ -31107,9 +31240,9 @@ function cleanupRemovedCursorArtifact(relativePath, paths, logger) {
   }
   if (relativePath.startsWith("commands/")) {
     removeManagedCompiledArtifact2(
-      path41.join(
+      path42.join(
         resolveTargetPath(paths.skills ?? ""),
-        path41.parse(relativePath).name,
+        path42.parse(relativePath).name,
         "SKILL.md"
       ),
       "cursor",
@@ -31153,9 +31286,9 @@ function cleanupRemovedClineArtifact(relativePath, paths, logger) {
   }
   if (relativePath.startsWith("rules/")) {
     removeManagedCompiledArtifact2(
-      path41.join(
+      path42.join(
         resolveTargetPath(paths.rules ?? ""),
-        `${path41.parse(relativePath).name}.md`
+        `${path42.parse(relativePath).name}.md`
       ),
       "cline",
       relativePath,
@@ -31165,9 +31298,9 @@ function cleanupRemovedClineArtifact(relativePath, paths, logger) {
   }
   if (relativePath.startsWith("commands/")) {
     removeManagedCompiledArtifact2(
-      path41.join(
+      path42.join(
         resolveTargetPath(paths.workflows ?? ""),
-        path41.basename(relativePath)
+        path42.basename(relativePath)
       ),
       "cline",
       relativePath,
@@ -31185,17 +31318,17 @@ function cleanupRemovedClineArtifact(relativePath, paths, logger) {
   }
 }
 function removeManagedCompiledArtifact2(artifactPath, expectedTarget, expectedSource, logger) {
-  if (!fs40.existsSync(artifactPath)) {
+  if (!fs41.existsSync(artifactPath)) {
     return;
   }
-  if (!fs40.statSync(artifactPath).isFile()) {
+  if (!fs41.statSync(artifactPath).isFile()) {
     return;
   }
-  const marker = extractProvenanceMarker(fs40.readFileSync(artifactPath, "utf8"));
+  const marker = extractProvenanceMarker(fs41.readFileSync(artifactPath, "utf8"));
   if (marker?.source !== expectedSource || marker.target !== expectedTarget) {
     return;
   }
-  fs40.rmSync(artifactPath, { force: true });
+  fs41.rmSync(artifactPath, { force: true });
   logger.verbose(`  removed stale target artifact: ${artifactPath}`);
 }
 function removeManagedCopilotMcpArtifact2(artifactPath, expectedSource, logger) {
@@ -31226,10 +31359,10 @@ function removeManagedCodexHooksArtifact2(artifactPath, expectedSource, logger)
   logger.verbose(`  removed stale target artifact: ${artifactPath}`);
 }
 function removeManagedCodexMcpArtifact2(artifactPath, expectedSource, logger) {
-  if (!fs40.existsSync(artifactPath)) {
+  if (!fs41.existsSync(artifactPath)) {
     return;
   }
-  const content = fs40.readFileSync(artifactPath, "utf8");
+  const content = fs41.readFileSync(artifactPath, "utf8");
   const startMarker = "# tangyr: managed mcp start";
   const endMarker = "# tangyr: managed mcp end";
   const startIndex = content.indexOf(startMarker);
@@ -31246,19 +31379,19 @@ function removeManagedCodexMcpArtifact2(artifactPath, expectedSource, logger) {
   const after = content.slice(endIndex + endMarker.length).trimStart();
   const cleaned = [before, after].filter((entry) => entry.length > 0).join("\n\n");
   if (cleaned.length === 0) {
-    fs40.rmSync(artifactPath, { force: true });
+    fs41.rmSync(artifactPath, { force: true });
   } else {
-    fs40.writeFileSync(artifactPath, `${cleaned}
+    fs41.writeFileSync(artifactPath, `${cleaned}
 `);
   }
   logger.verbose(`  removed stale target artifact: ${artifactPath}`);
 }
 function readJsonObject5(filePath) {
-  if (!fs40.existsSync(filePath)) {
+  if (!fs41.existsSync(filePath)) {
     return null;
   }
   try {
-    const parsed = JSON.parse(fs40.readFileSync(filePath, "utf8"));
+    const parsed = JSON.parse(fs41.readFileSync(filePath, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
@@ -31272,10 +31405,10 @@ function readJsonMetadata(value) {
 }
 function writeJsonOrRemove2(filePath, parsed) {
   if (isEmptyJsonValue2(parsed)) {
-    fs40.rmSync(filePath, { force: true });
+    fs41.rmSync(filePath, { force: true });
     return;
   }
-  fs40.writeFileSync(filePath, `${JSON.stringify(parsed, null, 2)}
+  fs41.writeFileSync(filePath, `${JSON.stringify(parsed, null, 2)}
 `);
 }
 function isEmptyJsonValue2(value) {
@@ -31335,8 +31468,8 @@ function removeManagedHookEntries(value, expectedSource) {
 }
 
 // src/commands/validate.ts
-import fs41 from "fs";
-import path42 from "path";
+import fs42 from "fs";
+import path43 from "path";
 var SUPPORTED_KIT_FORMATS2 = [1];
 var SUPPORTED_DISCIPLINE_VERSIONS = [
   "0.14.0",
@@ -31420,8 +31553,8 @@ function checkKitFormatSupported(kit) {
 }
 function checkEntrypointExists(kit) {
   const entrypoint = "CLAUDE.md";
-  const entrypointPath = path42.join(kit.path, entrypoint);
-  if (!fs41.existsSync(entrypointPath)) {
+  const entrypointPath = path43.join(kit.path, entrypoint);
+  if (!fs42.existsSync(entrypointPath)) {
     return {
       code: "entrypoint-missing",
       location: entrypoint,
@@ -31478,9 +31611,9 @@ function checkComponentFrontmatter(kit) {
     const missingSet = new Set(kit.components[cat].missing);
     for (const name of kit.components[cat].declared) {
       if (missingSet.has(name)) continue;
-      const filePath = cat === "skills" ? path42.join(kit.path, cat, name, "SKILL.md") : path42.join(kit.path, cat, `${name}.md`);
-      if (!fs41.existsSync(filePath)) continue;
-      const relPath = path42.relative(kit.path, filePath);
+      const filePath = cat === "skills" ? path43.join(kit.path, cat, name, "SKILL.md") : path43.join(kit.path, cat, `${name}.md`);
+      if (!fs42.existsSync(filePath)) continue;
+      const relPath = path43.relative(kit.path, filePath);
       try {
         const { data } = parseMarkdownFrontmatter(filePath);
         for (const field of requiredFields) {
@@ -31505,10 +31638,10 @@ function checkComponentFrontmatter(kit) {
 }
 function checkReservedRootNames(kit) {
   const violations = [];
-  if (!fs41.existsSync(kit.path) || !fs41.statSync(kit.path).isDirectory()) {
+  if (!fs42.existsSync(kit.path) || !fs42.statSync(kit.path).isDirectory()) {
     return violations;
   }
-  const entries = fs41.readdirSync(kit.path, { withFileTypes: true });
+  const entries = fs42.readdirSync(kit.path, { withFileTypes: true });
   for (const entry of entries) {
     if (RESERVED_ROOT_NAMES.includes(entry.name)) {
       violations.push({
@@ -31525,8 +31658,8 @@ function checkHumanOnlyCommandInvocation(kit) {
   const missingSet = new Set(kit.components.commands.missing);
   for (const name of kit.components.commands.declared) {
     if (missingSet.has(name)) continue;
-    const filePath = path42.join(kit.path, "commands", `${name}.md`);
-    if (!fs41.existsSync(filePath)) continue;
+    const filePath = path43.join(kit.path, "commands", `${name}.md`);
+    if (!fs42.existsSync(filePath)) continue;
     let data;
     try {
       ({ data } = parseMarkdownFrontmatter(filePath));
@@ -31539,7 +31672,7 @@ function checkHumanOnlyCommandInvocation(kit) {
     if (!barred) {
       violations.push({
         code: "command-human-only-model-invocable",
-        location: path42.relative(kit.path, filePath),
+        location: path43.relative(kit.path, filePath),
         message: "commands: 'launch: human-only' requires 'disable-model-invocation: true' so the model cannot start the command; only a Human-typed launch may"
       });
     }
@@ -31548,8 +31681,8 @@ function checkHumanOnlyCommandInvocation(kit) {
 }
 
 // src/commands/verify.ts
-import fs42 from "fs";
-import path43 from "path";
+import fs43 from "fs";
+import path44 from "path";
 function runVerifyCommand(options, logger) {
   const { config, configDir, sourceRoot, kitInfo } = resolveRuntime(
     options,
@@ -31640,8 +31773,8 @@ function verifyClaudeCodeGlobalRoots(roots, manifestKeys, mappings) {
       if (!slotPath) {
         continue;
       }
-      const fullPath = subPath ? path43.join(slotPath, subPath) : slotPath;
-      if (!fs42.existsSync(fullPath)) {
+      const fullPath = subPath ? path44.join(slotPath, subPath) : slotPath;
+      if (!fs43.existsSync(fullPath)) {
         failures.push(
           `claude-code/${slot}${subPath ? `/${subPath}` : ""} missing in root ${root}: ${fullPath}`
         );